Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-language robotics research skill that calls a public external knowledge API, with explicit safeguards against sending sensitive project data silently.
Install only if you are comfortable sending selected robotics research questions and non-sensitive project context to the disclosed public Entropy Box API. Do not send credentials, private datasets, personal information, confidential robot specifications, or safety-sensitive operational details unless you have deliberately reviewed and approved that disclosure.
The manifest sets language: "zh-CN", which indicates a fixed language/locale requirement. Under the policy rules, forcing a specific language is a violation unless the skill offers a language choice or clearly documents why the locale restriction is necessary; this file does not do either.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /api/search
curl --fail-with-body --silent --show-error \
--max-time 60 \
-X POST "https://xiangshang.ngrok.app/api/search" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /api/evidence/search
curl --fail-with-body --silent --show-error \
--max-time 60 \
-X POST "https://xiangshang.ngrok.app/api/evidence/search" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
优先使用 POST /api/lookup。
curl --fail-with-body --silent --show-error \
--max-time 60 \
-X POST "https://xiangshang.ngrok.app/api/lookup" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /api/consult
curl --fail-with-body --silent --show-error \
--max-time 200 \
-X POST "https://xiangshang.ngrok.app/api/consult" \
-H "Content-Type: application/json" \
The entire skill file is written in Chinese and instructs the agent to use this file when explaining the system or migrating the pattern, but it does not indicate that language choice is optional or limited to a China-specific context. This can violate language/locale policy because it implicitly constrains output or operation to a specific language without user opt-in.
The entire skill guidance is written in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The badge explicitly labels the skill language as zh-CN, and the README is entirely presented in Chinese without indicating alternative language support or user selection. This can violate the language/locale policy criterion because it imposes a locale-specific experience without opt-in or documented justification.
该文件是面向 API 使用者的参考文档，但标题及正文说明整体以中文呈现，未明确说明这是可选语言版本，也未提供语言/locale 选择。按照语言/locale 政策，强制单一语言而无用户 opt-in 可能构成自然语言层面的策略问题。
No suspicious patterns detected.