医学文献ppt生成skill

This skill appears to implement what it claims (search InfoX‑Med, fetch full text/figures, and render PPTX), but there are important red flags you should address before installing or running it: - Credentials & endpoint: The code expects INFOX_MED_TOKEN and uses an API base; metadata does not declare these. medical_search.py has a hard-coded API token and fetch_fullpaper.py defaults to an IP address (60.205.166.229:9306). Treat these as suspicious: verify the token and the endpoint with the skill author or your InfoX‑Med administrator before use. Do not assume the embedded token or IP are legitimate. - Data exfiltration risk: At runtime the scripts will send identifiers and perform network requests to external servers to retrieve full text and images. If you will process non-public or sensitive material, audit and control which network hosts are contacted and avoid sending sensitive content to untrusted endpoints. - Operational recommendations: - Ask the author to remove any hard-coded tokens and declare required env vars in the skill metadata (INFOX_MED_TOKEN, optional INFOX_MED_API_BASE). - If you proceed, supply your own token via environment variable and override API_BASE to the official InfoX‑Med domain if provided by your organization. - Run the skill in an isolated environment (restricted network) first and monitor outbound connections to verify the actual endpoints used. - Review and, if needed, replace the default API_BASE/IP and remove embedded credentials before trusting the skill in production. - Prefer obtaining this skill from a verified source or require the author to publish a homepage/release notes so you can validate provenance. Given these mismatches (undeclared env var, embedded token, IP default), treat the package as suspicious until the origin and the endpoint/credential issues are resolved.