Create Xgjk Skill
Security checks across malware telemetry and agentic risk
Overview
The skill's declared metadata and runtime instructions mostly match a Skill lifecycle tool, but there are important inconsistencies and risky implementation details (missing declared env requirements, automatic token usage policy, and disabled TLS checks) that merit caution before installing or running it.
What to consider before installing/using this skill: - Metadata mismatch: The package metadata lists no required env vars but the code and docs require XG_USER_TOKEN for publishing/updating/deleting; treat token presence as granting high privileges. Confirm whether you or your org will set XG_USER_TOKEN in the agent environment before enabling publish operations. - Explicit consent: Do not allow the skill to run publish/update/delete actions unless you explicitly authorize them at time of use. Prefer to run discovery and create flows (read-only) without any token set. - Review and run scripts offline first: Inspect scripts (publish_skill.py, upload_to_qiniu.py, register_skill.py, delete_skill.py) and test them in an isolated environment before giving the agent network access or tokens. - TLS verification: Several scripts disable TLS certificate checks (ssl.CERT_NONE). This weakens transport security and makes token interception possible. Fix/confirm TLS behavior before using environment tokens in production. - SSRF / arbitrary fetch: fetch_api_doc.py will fetch arbitrary URLs and can write them to disk; avoid letting it fetch untrusted or internal-only addresses. Restrict allowed doc URLs to known, trusted domains. - Least privilege: Use a token scoped only for the needed actions (prefer separate publish-scoped credentials), and rotate/revoke tokens after use. Avoid placing long-lived org-wide tokens in the environment. - Operational controls: If you must enable publishing, require interactive confirmation for any publish/update/delete, and log/audit all such actions. Consider running publish operations from a controlled CI/CD machine rather than an interactive agent with broad access. If you want, I can: - point out the exact lines in each script that read XG_USER_TOKEN and disable TLS so you can patch them, or - produce a minimal safe checklist/patches (e.g., re-enable TLS verification, require explicit --token argument for publish commands) to reduce risk.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings