Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward commodity-market data lookup integration that clearly sends user queries to a documented external API using a user-provided API key.
Install only if you are comfortable sending commodity-market queries and your XZ_APIKEY to Zhuochuang's API. Treat returned market data as provider-sourced, and confirm the API key source and billing terms before use.
The description and usage text repeatedly frame activation and operation around Chinese-language user queries such as '当用户询问…时使用' and '根据用户问句查询', with all examples exclusively in Chinese. This creates a natural-language locale constraint without any opt-in, alternative language support, or justification that the skill is region-specific only.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST --location 'https://api.zhuochuang.com/openclaw/data-search' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST --location 'https://api.zhuochuang.com/openclaw/data-search' \
--header 'Content-Type: application/json' \
--header 'apikey: ${XZ_APIKEY}' \
--data '{"query":"PTA市场价格走势"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST --location 'https://api.zhuochuang.com/openclaw/data-search' \
--header 'Content-Type: application/json' \
--header 'apikey: ${XZ_APIKEY}' \
--data '{"query":"PTA市场价格走势"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
'query': 'PTA市场价格走势' }
response = requests.post(url, headers=headers, json=data) print(response.json())
No suspicious patterns detected.