Huoban
Analysis
This is an instruction-only Huoban helper; it includes legitimate API, token, webhook, and data-mutation examples that users should handle carefully, but no hidden or automatic harmful behavior is evidenced.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
def create_item(...); def update_item(...); def delete_item(... resp = requests.delete(url, headers=self.headers)
The API client example includes create, update, and delete operations against Huoban records. This is aligned with API integration guidance, but these operations can alter business data.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
伙伴云 API 使用 API Token 认证... "Authorization": f"Bearer {api_token}"The skill documents use of a Huoban API token. This is expected for API integration, but the token may grant access to account data and actions.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
@app.route('/webhook/huoban', methods=['POST']) ... data = request.json ... event_type = data.get('event')The visible webhook example accepts external POST data and processes events. Webhook integration is purpose-aligned, but the shown snippet does not display origin/signature validation.