📦 User Interview — 用户访谈

v1.0.2

通过 Usercall 一键发起真实用户访谈，快速收集定性反馈，定位注册流失、功能困惑、定价疑虑等关键问题，助力产品迭代。

0· 192·0 当前·0 累计

by @junetic (Junetic)

API工具数据分析生产力工具测试工具

下载技能包

最后更新

2026/4/18

安全扫描

VirusTotal

无害

查看报告

OpenClaw

可疑

medium confidence

该技能的行为（使用 API 密钥调用 Usercall）与描述一致，但包元数据遗漏必需的 USERCALL_API_KEY，且运行指令明文回显密钥，存在泄露风险，整体不一致且令人担忧。

评估建议

This skill appears to do what it says (create and manage Usercall studies) but be cautious before installing or running it: - The SKILL.md requires USERCALL_API_KEY, yet the package metadata does not declare that — treat this as a packaging inconsistency and verify before trusting the skill. - The instructions explicitly echo your API key (echo "$USERCALL_API_KEY"). That prints your secret into the terminal/agent logs and can leak it. Do not run steps that print secrets; instead set the env var ...

详细分析 ▾

⚠ 用途与能力

The SKILL.md clearly targets Usercall and only needs a Usercall API key to create studies and fetch results, which is coherent with the stated purpose. However, the registry metadata listed under this bundle claims no required env vars while the instructions require USERCALL_API_KEY — an inconsistency between what the skill 'claims' and what it 'needs'.

⚠ 指令范围

Runtime instructions limit network calls to app.usercall.co and provide specific curl examples (expected). However, the instructions instruct the agent to run `echo "$USERCALL_API_KEY"` which will print the secret to the terminal/logs and can leak it in transcripts or logs. The SKILL.md also uses $ARGUMENTS (platform-provided) and tells the agent to accept media URLs — these are reasonable, but the explicit echo of the API key is an unnecessary and risky step.

✓ 安装机制

Instruction-only skill with no install spec and no code files — lowest install risk. All network calls are to the documented app.usercall.co API.

⚠ 凭证需求

Requesting a single USERCALL_API_KEY is proportionate to the described functionality. But the manifest metadata omission (it didn't declare the required env var) and the instruction to echo the key increases the chance of accidental credential exposure. Consider whether a scoped/revocable key can be used and whether the skill could avoid printing the secret.

✓ 持久化与权限

The skill does not request permanent/always-on presence and uses normal, user-invocable defaults. It does not modify other skills or request elevated platform privileges.

安全有层次，运行前请审查代码。

运行时依赖

无特殊依赖

版本

latestv1.0.22026/3/17

- 更新技能描述，明确仅需 USERCALL_API_KEY 环境变量，无需其他凭证或安装。 - 无功能或命令变更；使用说明保持不变。

● 无害

安装命令

点击复制

官方npx clawhub@latest install user-interview

镜像加速npx clawhub@latest install user-interview --registry https://cn.longxiaskill.com

技能文档

你正在帮助用户通过 Usercall 开展一次真实的用户访谈研究。 ## 步骤 1 —— 检查 API 密钥运行： ``bash echo "$USERCALL_API_KEY" ` 如果为空，告诉用户： > 要使用 openclaw，你需要一个 Usercall API 密钥。 > > 1. 在 https://app.usercall.co 注册 > 进入 Home → Developer → Create API key > > 2. 设置你的 API 密钥 > `bash > export USERCALL_API_KEY="your_key_here" > ` > 将这行添加到你的 ~/.zshrc 或 ~/.bashrc 使其永久生效，然后重启终端。 > > 接着再次运行 /user-interview。到此为止。 --- ## 步骤 2 —— 收集输入如果提供了 $ARGUMENTS，将其作为研究主题。否则询问： - 你想从用户那里了解什么？ - 关于产品或用户有什么背景？ - 你有没有原型或图片链接给参与者看？（可选——Figma 原型 URL 或 .png/.jpg/.gif/.webp） - 需要多少位参与者？（默认 1，后续可增加） --- ## 步骤 3 —— 创建研究 `bash curl -s -X POST https://app.usercall.co/api/v1/agent/studies \ -H "Authorization: Bearer $USERCALL_API_KEY" \ -H "Content-Type: application/json" \ -d '' ` JSON 体： `json { "key_research_goal": "", "business_context": "", "target_interviews": 1 } ` 可选字段：additional_context_prompt、language（auto 或 en）、duration_minutes。如需展示视觉素材，添加 study_media： `json { "study_media": { "type": "prototype", "url": "", "description": "" } } ` 直接图片 URL 使用 "type": "image"。 --- ## 步骤 4 —— 呈现结果 ` 研究已创建。将以下访谈链接分享给参与者：收集到足够回复后，请让我帮你获取结果。 ` --- ## 获取结果 `bash curl -s "https://app.usercall.co/api/v1/agent/studies//results?format=summary" \ -H "Authorization: Bearer $USERCALL_API_KEY" ` 为每个主题附上原话引用： ` Theme:

Quotes: - "" - "" ` --- ## 其他命令查看状态： `bash curl -s "https://app.usercall.co/api/v1/agent/studies/" \ -H "Authorization: Bearer $USERCALL_API_KEY" ` 增加名额： `

bash curl -s -X PATCH "https://app.usercall.co/api/v1/agent/studies/" \ -H "Authorization: Bearer $USERCALL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"target_interviews": }'

数据来源：ClawHub ↗ · 中文优化：龙虾技能库