小程序推广链接管理
v1.1.0小程序推广链接管理 skill。当用户需要创建推广链接或查询推广活动/渠道列表时使用。触发词：推广链接、推广活动、推广渠道、创建推广、推广列表、活动列表、渠道列表。注意：仅支持小程序/H5/小游戏应用，不支持 Android/iOS App。
⭐ 0· 60·0 current·0 all-time
byUmeng+@squall0925
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
The skill name/description (manage 小程序 promotion links) matches the included Umeng OpenAPI Python SDK and the entry script scripts/campaign.py (which implements create/list campaign actions). The SDK includes Umeng APIs such as umeng.umini.createCampaign which are exactly what the skill needs. Minor inconsistency: the skill metadata declares no required config paths or credentials, but the SKILL.md documents use of a local umeng-config.json or UMENG_CONFIG_PATH to supply API credentials.
Instruction Scope
SKILL.md instructions are narrowly scoped: collect app name, campaign/channel/path params, run scripts/campaign.py, and parse list/create outputs. The instructions explicitly reference a local config file (umeng-config.json) or UMENG_CONFIG_PATH. There are no instructions to read unrelated system files or to transmit data to endpoints other than the Umeng API.
Install Mechanism
This is an instruction-only skill with no install spec; code files are bundled in the skill (including an OpenAPI SDK and scripts/campaign.py). No external downloads, package managers, or archive extraction are requested by the metadata.
Credentials
The manifest lists no required env vars, but SKILL.md documents support for UMENG_CONFIG_PATH and a local umeng-config.json to hold Umeng appkey/secret. That is proportionate to the skill's function, but the skill does rely on local configuration that likely contains sensitive API credentials (appkey/secret) which should be treated as secrets and stored with appropriate permissions.
Persistence & Privilege
always:false and model invocation not disabled (defaults) — normal. The skill does not request to persist system-wide settings or to modify other skills per the provided files and instructions.
Assessment
This skill appears to be a legitimate Umeng-based tool for creating and listing mini-program promotion links. Before installing or running it: 1) Inspect scripts/campaign.py yourself (or ask for its contents) to confirm it only calls Umeng endpoints (gateway.open.umeng.com) and does not post data to unexpected servers. 2) Review the umeng-config.json that the skill will read — it will contain appkey/secret (sensitive); store it in a secure location, set UMENG_CONFIG_PATH if needed, and restrict file permissions. 3) Prefer creating a dedicated Umeng API key with minimal permissions for this tool rather than using high-privilege credentials. 4) If you cannot inspect the entry script, run in an isolated environment (container) and monitor network traffic. 5) Note the small metadata mismatch (no declared required config path) — don’t assume the platform will protect or validate the config file for you.Like a lobster shell, security has layers — review code before you run it.
latestvk978v9egaftxrnc80vhsefc0nn84wwsk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.