Ouyi API Tool

使用欧亿（ouyi）API 进行对话分析的 ACP skill。当用户要求使用 ouyi 模型、 欧亿模型、分析黄金、投资、技术问题等需要 AI 推理的任务时使用此 skill。 该 skill 通过本地 Node.js 脚本直接调用 ouyi API， 解决 OpenClaw 的 openai-completi...

Security Scan

The skill's code and runtime instructions match its stated purpose (calling the Ouyi chat API via a local Node.js script); there are minor documentation mismatches and a prompt-injection scan flag to review, but nothing that indicates the package is doing unrelated or disproportionate actions.

Purpose & Capability

Name/description state the skill will call the Ouyi chat API. The included Node.js script (scripts/ouyi-api.js) performs exactly that: it issues an HTTPS POST to api.rcouyi.com/v1/chat/completions and returns a JSON result. No unrelated binaries, services, or credentials are requested.

Instruction Scope

SKILL.md instructs the agent to read and exec the local Node.js script and parse its JSON output — that is consistent with the stated purpose. The script only constructs and sends the chat request and prints returned JSON; it does not access other files or external endpoints beyond api.rcouyi.com. Note: the SKILL.md suggests editing the script to replace an API key, while the script actually reads OUYI_API_KEY from the environment; this documentation mismatch should be resolved to avoid accidental credential handling mistakes.

Install Mechanism

There is no install spec and no external downloads; the skill is instruction + small local script files. This is the lower-risk model (nothing is fetched from arbitrary URLs or binaries installed). The package requires Node.js (declared in _meta.json).

Credentials

The script expects an API key via process.env.OUYI_API_KEY (or a placeholder in-code string). The registry metadata declared no required env vars / no primary credential, which is inconsistent with the script. The only credential involved is the Ouyi API key — that is proportional to the skill's purpose, but the metadata should declare OUYI_API_KEY so users know what will be needed and can supply it via env rather than editing source.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent privileges. It does not modify other skills or system-wide config. It will run a local Node.js script when invoked, which is expected for this skill type.

Scan Findings in Context

[system-prompt-override] expected: The pre-scan flagged a 'system-prompt-override' pattern in SKILL.md. The actual script defines a local variable systemPrompt ('You are a helpful assistant...') that the client sends to the remote API as the system role — this is expected for a chat client. Nevertheless, surface the flag as it could indicate an attempt to influence agent/system prompts; review SKILL.md and the script to ensure there are no hidden instructions that attempt to alter the local agent's system prompt or behavior beyond the chat request.

Assessment

This skill is coherent with its stated purpose (calling the Ouyi chat API) but take a few precautions before installing: 1) Provide your Ouyi API key via the OUYI_API_KEY environment variable rather than editing the script; update metadata to reflect this. 2) Review and confirm the endpoint (https://api.rcouyi.com) is the intended service and that you trust it — the skill will send the user's prompt to that remote service. 3) Avoid sending sensitive secrets or PII in prompts since they are forwarded externally. 4) Note the small documentation mismatch (SKILL.md suggests editing the script while the script reads from env); correct that to avoid accidental credential leakage. 5) The static scan flagged a possible 'system prompt' override pattern; although the script simply sets the message's system role, review SKILL.md and the script yourself to be comfortable that nothing in the skill attempts to override local agent/system prompts or perform unexpected actions.

ouyi Skill

核心脚本

路径：scripts/ouyi-api.js

API 配置

• API Key: 用户需要用自己的 ouyi API key 替换脚本中的 API_KEY
• 模型: ouyi-openclaw（内部映射到 gpt-5-nano-2025-08-07）
• Endpoint: https://api.rcouyi.com/v1/chat/completions

使用方式

1. 运行对话

node <skill_dir>/scripts/ouyi-api.js "你的问题"

2. 解析结果

输出格式（JSON）：

{"content": "回复内容", "reasoningTokens": 832, "model": "gpt-5-nano-2025-08-07", "error": null}

3. 发送结果

提取 content 字段，发送给用户。

示例问题

• "Is gold worth buying in 2025?"
• "Explain quantum computing to a 10-year-old in Chinese."
• "What is the difference between GDP and GNP?"

性能特征

• 响应时间：平均 5-10 秒（推理模型特性）
• 速度与 reasoning_tokens 无明显相关
• 支持中英文，质量稳定

已知问题

• reasoning_tokens 很大但 content 可能为空（当 max_tokens < 1500 时）
• 当前脚本不设置 max_tokens 来避免此问题
• 模型是推理模型，可能先输出推理过程再输出答案

配置

若要更换 API key，直接编辑 scripts/ouyi-api.js 中的：

const API_KEY = 'your-api-key-here';