📦 推送消息数据助手（友盟U Push）友盟推送后台管理助手（只读查询）。帮助获取应用列表、查询推送数据等。**使用前需用户提供 — 推送消息数据助手（友盟U Push） 友盟推送后台管理助手（只读查询）。帮助获取应用列表、查询推送数据等。 **使用前需用户提供
v1.0.0Cookie**：请访问 https://upush.umeng.com 登录后，在浏览器开发者工具的 Network 标签中复制 Cookie 并提交给系统。用于 Umeng push 相关操作。
0· 18·0 当前·0 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceThe skill appears to implement the advertised read-only Umeng push queries, but there are inconsistencies and privacy-sensitive behaviors (cookie handling, an auto cookie-acquisition script, and mixed storage paths) that warrant caution before installing or running it.
评估建议
This skill implements read-only queries for Umeng Push and expects you to provide your browser session cookie (ctoken and login id). Before installing or running it: 1) Do NOT paste full cookies into any public chat — that shares a live session token. Prefer storing cookies only locally using the provided scripts and run them locally, not in a hosted agent environment. 2) Inspect the bundled Python scripts (especially auto_get_cookie.py, browser_cookie.py, and any network code) yourself — auto_g...详细分析 ▾
ℹ 用途与能力
The skill's name/description (read-only Umeng push queries) align with the included scripts that call upush.umeng.com read APIs. No unrelated cloud credentials or unrelated binaries are requested. However, there is functionality around obtaining and storing browser cookies (auto_get_cookie, browser_cookie, manage_cookie) which is directly related to authentication but increases sensitivity; this capability is expected for a cookie-based integration but should be treated as sensitive.
⚠ 指令范围
Runtime instructions explicitly ask the user to provide their full browser Cookie (ctoken and login id) via the conversation or to run scripts that read browser cookies. The SKILL.md and README contain conflicting guidance: SKILL.md claims automatic browser-cookie retrieval is no longer supported, while README still recommends and documents scripts for automatic retrieval. Asking users to paste full cookies into chat or providing an automatic browser cookie reader broadens scope to highly sensitive data (session cookies) and increases risk of accidental exposure or exfiltration. The skill includes a security_interceptor to block write APIs, but that does not mitigate the risk of cookies leaking via logs, conversation history, or other code paths.
✓ 安装机制
No install spec is present (instruction-only with bundled scripts). That reduces supply-chain risk compared to remote downloads. All code is included in the bundle (Python scripts). There are no external download URLs in the provided manifest. Still, running included scripts will write files and perform network calls, so users should review code before executing.
ℹ 凭证需求
The skill requests no environment variables or external credentials in metadata, instead relying on session cookies supplied by the user — which is expected for a web-session-based integration. This is proportionate to the stated purpose, but cookies are very sensitive. The skill writes cookies to local files (cookie.json / cookie.txt) and some scripts reference ~/.qoderwork/... while others use script-relative storage, showing inconsistent paths. The skill sets file perms to 600 in at least one script, which is good, but the mix of filenames and locations increases the chance of confusion or accidental exposure.
⚠ 持久化与权限
The skill persists user session cookies to disk (~/.qoderwork/skills/umeng-push-helper/cookie.txt or cookie.json) and includes an 'auto_get_cookie' utility that appears to read browser cookies. The skill is not always:true, but it can be invoked autonomously. Combined with the cookie-handling behavior and the ability to save cookies, this increases the blast radius if the skill is allowed to run without human oversight. The presence of a security_interceptor that blocks write APIs is a mitigating control for API misuse, but it doesn't prevent cookie exfiltration via other means (logs, network calls to other hosts, or conversational transcripts).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/21
Umeng Push Helper 1.0.0 - Initial Release - Provides read-only tools for querying Umeng Push backend data, including app lists, push summaries, weekly reports, push trace analysis, switch statistics, and push closure attribution. - Strictly blocks all write or modification APIs for security; only read/query APIs are enabled. - Requires users to supply their own Umeng Cookie for all operations, with detailed step-by-step guidance for obtaining and saving the Cookie. - Offers command-line scripts for Cookie validation, management, and for fetching core push data. - Supports paginated queries and detailed field explanations for all listed functionalities.
● 可疑
安装命令
点击复制官方npx clawhub@latest install umeng-push-helper
镜像加速npx clawhub@latest install umeng-push-helper --registry https://cn.longxiaskill.com镜像同步中