📦 易软智联数据交互技能
v1.0.0易软（EasySoft）数据查询 Skill。当用户询问易软系统内的数据报表时触发。触发关键词：易软、报表、数据查询、收缴率、预收率、清欠率、欠费、应收、实收、月报。
0· 22·0 当前·0 累计
by 安全扫描
OpenClaw
安全
medium confidence该技能的请求和运行时指令与其声明的用途（查询 EasySoft 报告）一致——它向用户索要 EasySoft 凭据并在本地保存以供 API 调用，这与描述的连接器行为相符。
评估建议
This skill appears to be a legitimate EasySoft report connector, but it asks you to provide and store sensitive credentials locally. Before installing: 1) Confirm you trust the skill source (there is no homepage and the publisher is unknown). 2) Prefer creating a least-privilege account in EasySoft (not an admin) for the skill. 3) Ask the author or vendor where exactly credentials are stored (file path), how hardware-binding is implemented, and whether you can inspect the encryption code — becau...详细分析 ▾
✓ 用途与能力
The name/description match the runtime instructions: the skill is an EasySoft report connector and its documented flows (prompt for property Key, username, password; authenticate; call report APIs) align with that purpose. It does not request unrelated services or credentials.
✓ 指令范围
SKILL.md focuses on prompting for credentials, mapping API parameters, guiding report selection, and formatting/display rules. All referenced actions (load local encrypted credentials, derive API endpoint from property Key, verify login, call report APIs) are within the expected scope for a connector. There are no instructions to read unrelated system files or exfiltrate data to third-party endpoints.
✓ 安装机制
This is an instruction-only skill with no install spec and no bundled code to execute; that minimizes install-time risk. No downloads, external packages, or binaries are required by the skill package itself.
ℹ 凭证需求
The skill requires sensitive credentials (property Key, username, password) entered interactively and stored locally — this is expected for a system connector but is sensitive by nature. The manifest does not declare env vars because credentials are provided at runtime; no unrelated secrets or cloud credentials are requested.
ℹ 持久化与权限
The skill will persist encrypted credentials on the user's machine (described as AES-256 and hardware-bound). Persisting credentials locally is expected for convenience, but it increases attack surface if the implementation or storage location is insecure. Autonomous invocation is allowed (default), which combined with stored credentials raises the blast radius if the skill or platform were compromised — this is not inherently malicious but worth considering.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/17
easysoftskill 1.0.0 – 初始版本上线 - 实现易软（EasySoft）物业系统数据查询技能，支持跨平台（QClaw、OpenClaw 等）安装。 - 新增凭证初始化及加密存储流程，首次使用需用户输入公司 Key、账号、密码。 - 上线“欠费报表”查询功能，并提供完整的分步参数引导与多报表结果类型切换。 - 提供标准化的 API 参数校验与接口映射，严格约束查询参数格式。 - 支持智能 API 字段前缀识别与列名映射，自动优化数据表格展示。 - 查询完成后自动引导用户快速切换至同组其它报表。
● 无害
安装命令
点击复制官方npx clawhub@latest install easysoftskill
镜像加速npx clawhub@latest install easysoftskill --registry https://cn.longxiaskill.com