Devin_dingcheng

This skill appears to perform legitimate queries against a vendor API, but it has several things you should consider before running or installing it: - Do not paste real keys/phone numbers into the script file in plaintext. Instead, modify the script to read KEY, TEL, and IMEI from environment variables or a protected config file, or prompt at runtime. - The script uses jq (and curl). Ensure jq is installed from a trusted package source before running. The skill metadata should list these dependencies but does not — treat that as an omission. - Verify the endpoint (https://www.cd6969.com) is the legitimate vendor service you expect. If you do not recognize the domain, validate with the device vendor or use network isolation/testing with dummy credentials. - Review the script locally before executing. It is short and readable; ensure it only posts the device key/tel and parses the response as shown. - For safer testing, use dummy values and run in an isolated environment (container/VM) first. If you plan to use this skill long-term, ask the publisher to: declare required binaries (curl, jq), provide a secure configuration method (env vars or secret store) rather than hard-coded credentials, and include a brief security note about what data is sent to the vendor endpoint.