安全扫描
OpenClaw
安全
high confidenceThe skill's requested resources, instructions, and bundled script align with its stated purpose (Dievio lead search and LinkedIn lookup); nothing requests unrelated secrets or installs arbitrary code, but you should verify the skill source and be cautious with raw output since it may contain PII.
评估建议
This skill appears to do what it claims: it calls Dievio endpoints and needs only DIEVIO_API_KEY. Before installing: (1) verify the publisher/repo (SKILL.md references a GitHub repo but registry metadata lacks a homepage/source), (2) only provide an API key you trust and, if possible, a limited-scope or test key, (3) avoid using --raw-output unless you need full rows (it can include emails/phones/PII and could be logged), and (4) be aware the skill will perform network requests to dievio.com and...详细分析 ▾
ℹ 用途与能力
Name, README, SKILL.md, and the included Python CLI all consistently implement Dievio lead search and LinkedIn lookup via POST to dievio.com endpoints. The only mild inconsistency: registry metadata lists source/homepage as unknown/none while SKILL.md/README provide a GitHub URL and dievio.com homepage — worth verifying but not suspicious by itself.
✓ 指令范围
SKILL.md instructs the agent to authenticate with DIEVIO_API_KEY, build request payloads, paginate, and handle errors. The bundled script implements those steps and only reads local JSON body files and the DIEVIO_API_KEY environment variable; it does not attempt to read other system files or unrelated environment variables. SKILL.md warns not to print secrets and notes raw output may include emails/phones.
✓ 安装机制
No install spec; skill is instruction-only with a small Python script included. No downloads from arbitrary URLs or archive extraction are present. Risk from installation is low (script runs from disk if executed).
✓ 凭证需求
Only requires a single API key (DIEVIO_API_KEY), which is appropriate for an API-integration skill. The script allows an --api-key override and otherwise reads os.getenv('DIEVIO_API_KEY'); no other credentials or secrets are requested or accessed.
✓ 持久化与权限
Skill does not request persistent/always-on inclusion (always: false) and does not modify other skills or system-wide settings. It can be invoked autonomously by the agent (default behavior) but that is expected for a callable skill; no elevated privileges requested.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/2/27
Security hardening follow-up: fixed host pinning and default-safe output.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install dievio-lead-search-api
镜像加速npx clawhub@latest install dievio-lead-search-api --registry https://cn.clawhub-mirror.com
技能文档
Overview
Use this skill for end-to-end Dievio API execution: authenticate requests, submit lead searches, enrich LinkedIn profiles, and paginate results. Prefer the bundled script for deterministic request formatting and response handling.
Core Endpoints
- Public lead search:
POST https://dievio.com/api/public/search - LinkedIn lookup:
POST https://dievio.com/api/linkedin/lookup
Authentication headers (use one):
Authorization: Bearer YOUR_API_KEYX-API-Key: YOUR_API_KEY
Workflow
- Validate credentials:
- Require
DIEVIO_API_KEYfor API-key flows. - Never print raw secrets.
- Build request body:
- Search endpoint uses pagination keys (
_page,_per_page,max_results) plus filters. - LinkedIn lookup requires
linkedinUrlsand optional output flags.
- Execute request and parse response:
- Validate
success,count,has_more,next_page, data arrays. - Respect credit behavior: low credits can return fewer rows than requested.
- Handle errors:
401: missing/invalid credentials402: insufficient credits502: upstream lead service issue500: server error
Commands
Show help:
python3 scripts/dievio_api.py --help
Search with JSON body:
export DIEVIO_API_KEY="your_api_key"
python3 scripts/dievio_api.py search \
--body-file ./search_body.json \
--auto-paginate
By default the CLI prints a safe summary.
Use --raw-output only when you explicitly need full rows (which may contain emails/phones).
LinkedIn lookup from URLs:
python3 scripts/dievio_api.py linkedin-lookup \
--linkedin-url "https://www.linkedin.com/in/example-1" \
--linkedin-url "https://www.linkedin.com/in/example-2" \
--include-work-emails \
--include-personal-emails \
--only-with-emails
Decision Rules
- Use
searchwhen query is filter-based lead discovery. - Use
linkedin-lookupwhen input is explicit LinkedIn profile URLs. - For large pulls, enable pagination and stop on
has_more=false. - Keep outputs structured and include paging fields for traceability.
- If user asks for exact filter values, read references/filters-cheatsheet.md.
References
- API contracts: references/api-reference.md
- Filter fields and allowed values: references/filters-cheatsheet.md
- Pagination behavior: references/pagination.md
- Error handling guidance: references/errors.md
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制