Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

全国招中标信息、政府采购项目查询-保标招标

v1.0.1

全国招标中标采购信息搜索 - 保标招标 - 支持多条件筛选的招投标数据搜索,返回项目金额、甲方、乙方、代理机构、采集源网址等核心字段。

0· 103·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for brade888/sbkj-bidsearch.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "全国招中标信息、政府采购项目查询-保标招标" (brade888/sbkj-bidsearch) from ClawHub.
Skill page: https://clawhub.ai/brade888/sbkj-bidsearch
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install sbkj-bidsearch

ClawHub CLI

Package manager switcher

npx clawhub@latest install sbkj-bidsearch
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description align with the included code: both implement a bidding/procurement search that POSTs to an external API and returns project fields. Requiring an API key is appropriate for this purpose. However, the registry metadata claims no required environment variables/credentials while SKILL.md (and the code) require BID_API_KEY (and optionally BID_SERVER_URL) — an inconsistency worth verifying with the publisher.
Instruction Scope
SKILL.md and scripts/bid_search.py limit actions to building requests and calling the declared API endpoint. They read only BID_API_KEY and BID_SERVER_URL (and CLI args) and do not attempt to read unrelated system files or other credentials. Examples reference platform credential helpers (get_credential) which is platform-specific but expected.
Install Mechanism
There is no install spec (instruction-only skill with a bundled client script). No external downloads or archive extraction are performed. The included Python script is plain and self-contained.
!
Credentials
The SKILL.md declares a required sensitive credential BID_API_KEY, which the code enforces; this is proportionate to making authenticated API calls. The concern is the mismatch with the registry metadata which lists no required env vars/primary credential — this could lead users to miss configuring the key or misunderstand risk. Only one sensitive variable is required, which is otherwise reasonable.
Persistence & Privilege
always is false and the skill does not request system-wide configuration changes or persist credentials beyond standard platform mechanisms. Autonomous invocation (disable-model-invocation=false) is the platform default and not flagged alone.
What to consider before installing
This skill appears to do what it says: it sends POST requests to an external bidding API and returns results. Before installing: (1) Verify the API key source and obtain the key from a trusted channel; (2) Confirm the API domain (SKILL.md uses https://gate.gov-bid.com while the package homepage is https://www.bog-bid.com) — ask the publisher if these domains are correct; (3) Note the registry metadata does not list BID_API_KEY even though SKILL.md and the script require it — ensure the platform will prompt for/stores the key securely; (4) Review the included script (it is readable and only calls the API) and test in a sandbox environment; (5) Use environment-variable or platform credential storage, restrict and rotate the key, and monitor usage. If you cannot verify the publisher or the domain mismatch, treat the credential as sensitive and delay installation.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dt85hk9z0084yqsspxss84n85bs0r
103downloads
0stars
2versions
Updated 6d ago
v1.0.1
MIT-0

⚠️ 安全提示

本技能会向外部 API 发送 HTTP 请求

关键信息

项目说明
API 端点https://gate.gov-bid.com/outer-gateway/bid/SearchProjectForAI
请求方式POST (JSON)
凭证要求BID_API_KEY (必需)
数据来源第三方招标采购信息服务
执行代码scripts/bid_search.py

安装前必读

请确认以下事项后再安装:

  1. ✅ 您已从合法渠道获取 API 访问密钥
  2. ✅ 您信任 API 服务提供商 (gate.gov-bid.com)
  3. ✅ 您已审查技能代码(特别是 scripts/bid_search.py
  4. ✅ 您了解技能会向外部服务器发送您的 API 密钥
  5. ✅ 您已在安全环境中测试或限制 API 密钥权限

安全最佳实践

# 1. 使用环境变量管理密钥(不要硬编码)
export BID_API_KEY="your_api_key_here"

# 2. 限制 API 密钥权限(如服务商支持)
# 3. 定期轮换密钥
# 4. 在生产环境使用前先测试
# 5. 监控 API 使用情况

招标采购信息搜索 API 技能

技能描述

封装第三方招标采购信息搜索接口,专为 AI 模型设计,支持多条件筛选的招投标数据搜索。

数据覆盖: 招标信息、中标信息、合同信息、采购意向、拍租信息等

返回核心字段: 项目金额、甲方信息、乙方信息、代理机构、合同到期时间等

安装配置

必需凭证

凭证名说明是否必需示例
BID_API_KEYAPI 访问密钥✅ 是AK729447427d63c2320ff44c7a
BID_SERVER_URLAPI 服务器地址❌ 否https://gate.gov-bid.com

安装步骤

方式 1:环境变量

export BID_API_KEY="your_api_key_here"
export BID_SERVER_URL="https://gate.gov-bid.com"

方式 2:Hermes 凭证管理(推荐)

# ~/.hermes/config.yaml
credentials:
  BID_API_KEY: "your_api_key_here"
  BID_SERVER_URL: "https://gate.gov-bid.com"

方式 3:技能安装时配置

skill_install sbkj-bidsearch

验证安装

skill_view sbkj-bidsearch

使用方法

基本搜索

from hermes_tools import terminal

result = terminal('''
python3 << 'EOF'
from skill_view import get_credential
import requests

api_key = get_credential("BID_API_KEY")
url = f"https://gate.gov-bid.com/outer-gateway/bid/SearchProjectForAI?key={api_key}"

payload = {
    "keyword": "工程",
    "className": "招标信息",
    "startDate": "2025-01-10",
    "endDate": "2025-01-17",
    "pageId": 1,
    "pageNumber": 20
}

response = requests.post(url, json=payload)
data = response.json()

if data.get("code") == 200:
    print(f"找到 {data['data']['total']} 条记录")
else:
    print(f"错误:{data.get('msg')}")
EOF
''')

Python 函数封装

def search_bid_projects(
    keyword=None,
    exclude_kw=None,
    include_kw=None,
    class_name=None,
    area_name=None,
    search_field="全部",
    start_date=None,
    end_date=None,
    page_id=1,
    page_number=20
):
    """搜索招标采购项目"""
    from skill_view import get_credential
    import requests
    
    api_key = get_credential("BID_API_KEY")
    server_url = get_credential("BID_SERVER_URL") or "https://gate.gov-bid.com"
    
    url = f"{server_url}/outer-gateway/bid/SearchProjectForAI?key={api_key}"
    
    payload = {
        "startDate": start_date,
        "endDate": end_date,
        "pageId": page_id,
        "pageNumber": page_number
    }
    
    if keyword: payload["keyword"] = keyword
    if exclude_kw: payload["excludeKW"] = exclude_kw
    if include_kw: payload["inCludeKW"] = include_kw
    if class_name: payload["className"] = class_name
    if area_name: payload["areaName"] = area_name
    if search_field: payload["searchField"] = search_field
    
    response = requests.post(url, json=payload, timeout=30)
    return response.json()

请求参数说明

参数名必填类型说明
keywordstring搜索关键词:空格=同时出现,竖线=或关系
excludeKWstring排除关键词,多个用竖线分隔
inCludeKWstring必须包含关键词,多个用竖线分隔
classNamestring项目类别:全部信息/招标信息/中标信息/合同信息/采购意向/拍租信息
areaNamestring项目归属地区名称(如"武汉")
searchFieldstring搜索字段:标题、内容、全部(默认"全部")
startDatestring发布开始日期,格式:yyyy-MM-dd
endDatestring发布结束日期,格式:yyyy-MM-dd
pageIdint当前页码
pageNumberint每页记录数(最大 100,设为 0 仅返回总数)

返回参数说明

顶层响应

参数名类型说明
codeint接口响应状态码(200=成功)
msgstring响应信息
subCodestring业务侧 code
subMsgstring业务侧 msg
dataobject业务数据

项目列表项字段

字段说明
id项目 ID
title项目标题
newsTypeName信息类型名称
publishTime发布时间
areaName地区(省/市/区)
projectMoney项目金额
projectClass项目类别
purchaseType采购类型
partAInfo甲方信息数组(name, contactPhone, email)
partBInfo乙方信息数组
agencyInfo代理机构信息数组

常见用例

1. 获取某地区最新招标公告

result = search_bid_projects(
    class_name="招标信息",
    area_name="上海",
    start_date="2025-01-15",
    end_date="2025-01-17"
)

2. 搜索特定关键词的中标信息

result = search_bid_projects(
    keyword="智慧城市",
    class_name="中标信息",
    start_date="2025-01-01",
    end_date="2025-01-17"
)

3. 排除特定关键词

result = search_bid_projects(
    keyword="空调",
    exclude_kw="维修 | 保养",
    class_name="招标信息",
    start_date="2025-01-10",
    end_date="2025-01-17"
)

4. 仅获取结果总数

result = search_bid_projects(
    keyword="工程",
    start_date="2025-01-01",
    end_date="2025-01-17",
    page_number=0
)
print(f"总数:{result['data']['total']}")

错误处理

状态码说明处理建议
200成功正常处理返回数据
401认证失败检查 BID_API_KEY 是否正确
403权限不足联系 API 服务提供商
500服务器错误稍后重试
504网关超时检查网络或稍后重试

注意事项

  1. API Key 安全:不要将 API Key 硬编码在代码中
  2. 请求频率:建议控制请求频率,避免触发限流
  3. 日期格式:必须使用 yyyy-MM-dd 格式
  4. 分页限制pageNumber 最大值为 100
  5. 关键词语法:空格=AND,竖线=OR

隐私与数据保护

  • 数据传输:所有请求通过 HTTPS 加密传输
  • 凭证存储:API Key 存储在本地凭证管理系统或环境变量中
  • 日志记录:技能本身不记录请求日志

故障排查

问题:返回 401 认证失败

解决:检查 BID_API_KEY 是否正确配置

问题:返回数据为空

解决

  1. 检查日期范围是否合理
  2. 尝试放宽搜索条件
  3. 设置 pageNumber=0 先查看是否有匹配记录

问题:请求超时

解决

  1. 检查网络连接
  2. 增加请求超时时间
  3. 减少 pageNumber

技术细节

代码结构

sbkj-bidsearch/
├── SKILL.md
└── scripts/
    └── bid_search.py

网络请求详情

  • 协议: HTTPS
  • 方法: POST
  • Content-Type: application/json
  • 超时: 30 秒

依赖项

  • Python 3.7+
  • requests 库

更新日志

版本日期变更
1.0.12026-04-22更新许可证为 MIT-0,更新 homepage
1.0.02026-04-21初始版本

参考链接


最后更新: 2026-04-22
技能版本: 1.0.1
许可证: MIT-0 (无需署名)

Comments

Loading comments...