Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

自定义事件管理

v1.1.0

友盟自定义事件管理入口 skill。当用户需要创建埋点事件定义、批量创建事件、查询事件列表时使用。触发词:创建事件、添加埋点、批量创建事件、事件列表、自定义事件管理。

0· 94·0 current·0 all-time
byUmeng+@squall0925

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for squall0925/uapp-event-manage.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "自定义事件管理" (squall0925/uapp-event-manage) from ClawHub.
Skill page: https://clawhub.ai/squall0925/uapp-event-manage
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install uapp-event-manage

ClawHub CLI

Package manager switcher

npx clawhub@latest install uapp-event-manage
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the included Umeng OpenAPI Python SDK and the event_manage.py entrypoint; the SDK files and CLI semantics are plausible for creating/querying Umeng custom events. However, the registry metadata declares no credentials or env vars while the SKILL.md and SDK expect a local umeng-config.json or UMENG_CONFIG_PATH and API credentials — metadata omission is inconsistent with the skill's stated purpose.
!
Instruction Scope
SKILL.md instructs the agent to run scripts/event_manage.py and to read configuration from a file (default umeng-config.json) or UMENG_CONFIG_PATH; it also supports a --from-file path for batch creation. That means at runtime the script will read files from disk (current dir or arbitrary paths provided by user). The instructions do not declare limits on which paths are safe to read; the presence of an env var and config-file flow is not documented in registry metadata, so the agent may access credentials/configuration unexpectedly.
Install Mechanism
No install spec — instruction-only skill with bundled Python files. There's no network download/install step in the registry metadata. Including an SDK source tree in the bundle is expected for an API client and is proportionate.
!
Credentials
The skill requests no env vars in metadata, but SKILL.md documents UMENG_CONFIG_PATH and a local umeng-config.json file that will hold API credentials. The skill therefore requires secrets (Umeng appkey/secret or access tokens) at runtime but does not declare them as required/primary credential in metadata — this mismatch is a red flag. The number of environment/credential items is reasonable for the function, but they must be declared and handled transparently.
Persistence & Privilege
always: false and no special persistence or modification of other skills detected. The skill is user-invocable and can be invoked autonomously (platform default), which is normal and not by itself a concern.
What to consider before installing
This package appears to implement an Umeng custom-event CLI and includes the Umeng OpenAPI Python SDK, which is consistent with its description. However: 1) the registry metadata does not declare that the skill needs Umeng credentials or the UMENG_CONFIG_PATH env var even though SKILL.md and the scripts expect a umeng-config.json — ask the publisher or inspect the repo to confirm what credentials will be read and where; 2) inspect scripts/event_manage.py and any umeng-config.json example in the bundle before running: verify it only contacts Umeng endpoints (gateway.open.umeng.com / open.1688.com) and does not send data elsewhere; 3) be cautious when supplying file paths for --from-file or allowing the script to use the current directory, since it will read files from disk; avoid pointing it at directories containing unrelated secrets; 4) run the script in an isolated environment (dedicated account/VM) or with least-privilege credentials first; 5) request the publisher to update the skill metadata to list required env vars/credentials (UMENG_CONFIG_PATH, appkey/secret or access tokens) so you can make an informed consent decision. If you want, I can inspect scripts/event_manage.py and any umeng-config.json sample in the bundle for specific network calls, credential handling, and file-read behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk979624gwnf74b8xbawqhpyxn984x7cp
94downloads
0stars
2versions
Updated 1w ago
v1.1.0
MIT-0

使用流程

Step 1:确认应用名称

  • 用户未提及应用名时,询问:「请问是哪个应用?」

Step 2:确认操作意图和参数

  • 创建单个事件 → 确认事件名(英文+下划线)和显示名称(中文)
  • 批量创建 → 仅小程序支持,确认 JSON 格式列表或文件路径
  • 查询事件列表 → 直接执行 --list-events

Step 3:执行并反馈

  • 创建成功后明确告知用户事件名称
  • 创建失败时,如无返回错误信息,可用 --verify 确认是否已存在

边界条件与异常处理

情形处理方式
用户未说应用名先询问,不要猜测
App名找不到提示「可用 uapp-assets 查询应用列表」
事件名包含特殊字符告知仅支持英文字母、数字和下划线,不允许 ? / . \ < > 等特殊符号
App 类型使用批量创建告知「批量创建仅支持小程序类型应用,请逐个使用 --create」
创建后立即验证不存在告知「事件同步需要几秒,--verify 可能暂时返回不存在,稍后再查即可」

典型问法与内部意图映射

典型问法内部意图(CLI 参数)
"创建一个叫purchase_click的事件"--create "purchase_click" --display-name "购买点击" --app "Android_Demo"
"帮我批量创建这几个小程序事件"--batch-create --events '[...]' --app "友小盟数据官"
"创建一个数值型事件"--create "purchase_amount" --display-name "购买金额" --event-type true --app "Android_Demo"
"创建事件并确认是否成功"--create "test_event" --display-name "测试事件" --verify --app "Android_Demo"
"查看当前应用有哪些自定义事件"--list-events --app "友小盟数据官"

支持的操作模式

事件列表查询

参数说明
--list-events查询当前应用的所有自定义事件

平台支持:App类型和小程序类型均支持事件列表查询

单个事件创建

参数必填说明
--create EVENT_NAME事件名称(英文标识)
--display-name DISPLAY_NAME事件显示名称(中文)
--event-type TYPE事件类型:true=计算事件(数值型),false=计数事件(字符串型)。默认不传(API默认false)
--verify创建后验证事件是否存在

平台支持:App类型和小程序类型均支持单个事件创建

批量事件创建

参数必填说明
--batch-create批量创建模式
--events JSON_STRING二选一JSON字符串格式的事件列表
--from-file FILE_PATH二选一JSON文件路径

平台限制:仅小程序类型应用支持批量创建

事件类型说明

eventType类型说明
true计算事件(数值型)用于统计数值型变量的累计值、均值及分布
false计数事件(字符串型)用于统计字符串型变量的消息数及触发设备数

注意:不指定 --event-type 时,API默认使用 false(计数事件)

批量创建JSON格式

[
  {"eventName": "click_btn", "displayName": "点击按钮"},
  {"eventName": "view_page", "displayName": "浏览页面"}
]

调用示例

事件列表查询

# 查询小程序事件列表
python3 scripts/event_manage.py --list-events --app "友小盟数据官"

# 查询App事件列表
python3 scripts/event_manage.py --list-events --app "Android_Demo"

# JSON 输出
python3 scripts/event_manage.py --list-events --app "友小盟数据官" --json

单个事件创建

# 创建App类型事件(计数事件,默认)
python3 scripts/event_manage.py --create "purchase_click" --display-name "购买点击" --app "Android_Demo"

# 创建App类型计算事件(数值型)
python3 scripts/event_manage.py --create "purchase_amount" --display-name "购买金额" --event-type true --app "Android_Demo"

# 创建小程序类型事件
python3 scripts/event_manage.py --create "view_page" --display-name "浏览页面" --app "友小盟数据官"

# 创建并验证
python3 scripts/event_manage.py --create "test_event" --display-name "测试事件" --verify --app "Android_Demo"

批量事件创建(仅小程序)

# 使用JSON字符串
python3 scripts/event_manage.py --batch-create --events '[{"eventName":"click1","displayName":"点击1"},{"eventName":"click2","displayName":"点击2"}]' --app "友小盟数据官"

# 使用文件
python3 scripts/event_manage.py --batch-create --from-file events.json --app "友小盟数据官"

JSON 输出

添加 --json 参数获取结构化数据:

python3 scripts/event_manage.py --create "test_event" --display-name "测试事件" --json --app "Android_Demo"

配置方式

  1. --config /path/to/umeng-config.json: 显式指定配置文件
  2. export UMENG_CONFIG_PATH=/path/to/umeng-config.json: 环境变量
  3. 在当前目录创建 umeng-config.json: 默认查找

配置文件格式参见项目根目录 umeng-config.json 示例。

平台类型自动识别

脚本根据应用配置中的 platform 字段自动选择API:

平台API接口
Android / iOS / HarmonyOSumeng.uapp.event.create
微信小程序 / 支付宝小程序 / 百度小程序 / 字节跳动小程序 / QQ小程序 / H5 / 小游戏umeng.umini.batchCreateEvent

注意事项

  1. App类型不支持批量创建:如需创建多个事件,请逐个使用 --create
  2. 事件名称冲突:创建已存在的事件可能报错或覆盖,建议使用 --verify 验证
  3. 中文显示名称:App类型事件的中文名称会自动进行URL编码
  4. 验证延迟:事件创建后可能需要几秒钟同步,--verify 可能在创建后立即验证时返回不存在
  5. 参数格式限制
    • eventName:只能包含英文字母、数字和下划线,不允许特殊符号 ? / . \ < >
    • displayName:只能包含中文、英文、数字和下划线,不允许特殊符号 ? / . \ < >

Comments

Loading comments...