仙宫云GPU管家

This skill appears to be an API client for 仙宫云 and implements the advertised operations, but there are a few issues to consider before installing: - Credential handling mismatch: the registry metadata does not declare any required credentials or config paths, yet the included script requires config/config.yaml with an access_token. The provided config file contains the placeholder "YOUR_ACCESS_TOKEN_HERE" — you must replace it with a real token for the skill to work. Treat this as sensitive data. - Do not store secrets in repository files if you can avoid it. Prefer injecting the API token through your platform's secret manager or environment variables rather than embedding it in a plaintext config inside the skill bundle. - Verify the API endpoint (https://api.xiangongyun.com) is the legitimate vendor endpoint you expect. If you don't recognize/ trust the skill's source (owner ID unknown, no homepage), exercise extra caution. - Because the script issues network requests using the token, only grant the minimum-scoped token necessary and consider testing the skill from a sandboxed account or environment first. - If you need stricter assurance, ask the publisher for: (1) confirmation of where the token should be stored (platform secret vs. file), (2) a signed/official source or homepage, and (3) justification for any persistent storage of credentials. Given the clear mismatch between declared metadata and actual requirements, treat this as suspicious until you confirm the credential handling and source provenance.