Security checks across malware telemetry and agentic risk
The skill mostly matches its Amazon category-analysis purpose, but it automatically uses a local Sorftime API credential and sends it in URL-based requests, so it needs user review before installation.
Review before installing. Use a dedicated low-privilege Sorftime key, prefer an environment variable over storing keys in .mcp.json, avoid sharing generated logs/raw response files, and be aware that category queries and business research targets are sent to Sorftime. Open the generated dashboard only if you are comfortable with its external ECharts CDN dependency.
# 代码示例
def get_api_key():
# 1. 尝试环境变量
api_key = os.environ.get('SORFTIME_API_KEY', '')
if api_key:
return api_key### 调用格式
```bash
curl -s -X POST "https://mcp.sorftime.com?key=YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{"amzSite":"US","nodeId":"NODE_ID"}}}'
```#### 步骤 1: 搜索类目获取 nodeId
```bash
curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"品类关键词"}}}'
```**获取 NodeID 的方法**:
```bash
# 先用大类目搜索，查看返回的子类目列表
curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Laptop"}}}'
```5. **测试 API 连接**:
```bash
curl -s -X POST "https://mcp.sorftime.com?key={YOUR_KEY}" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Kitchen"}}}'
```65/65 vendors flagged this skill as clean.