Security audit
Security checks for vulnerabilities and agentic risk
This skill gives disclosed guidance for adding the Umeng U-APP analytics SDK to an Android app, with privacy-sensitive behavior that matches its stated purpose.
Install this only if you intend to add Umeng analytics to an Android app. Review the added permissions, dependency versions, privacy-policy text, and consent-before-initialization flow carefully, especially because analytics SDKs may collect device identifiers and optional location-related data.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
~/.openclaw/skills/umeng-uapp-integration/SKILL.md
The trigger list includes generic terms such as “统计 SDK”, “移动统计”, and “应用埋点”, which can cause this Android/Umeng-specific skill to activate for broader analytics discussions where it is not appropriate. Mis-triggering can lead the agent to suggest adding third-party tracking SDKs, permissions, and initialization code in unrelated contexts, increasing privacy, compliance, and code-change risk.
The natural-language instructions, usage guidance, and examples are all presented in Chinese, effectively forcing a specific language for users of the skill. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific compliance reason.
No suspicious patterns detected.