Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed suspension CAD workflow for JixieTools, but it sends user design parameters to an external guest production service.
Install only if you are comfortable sending suspension design inputs to jixietools.com and receiving a no-login guest link for the resulting production sheet. Avoid entering proprietary or confidential engineering data unless that external workflow is acceptable for your project.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
用 curl 获取悬架列表：
curl -s "https://jixietools.com/api/v1/products?category_id=26" | python3 -m json.tool
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
用 curl 获取悬架列表:
curl -s "https://jixietools.com/api/v1/products?category_id=26" | python3 -m json.tool
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
用户选择后，获取该产品的参数定义：
curl -s "https://jixietools.com/api/v1/products/PRODUCT_ID/start" | python3 -m json.tool
返回包含 input_params、output_params、debug_params、coefficient_params 四类参数。
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl -s -X POST "https://jixietools.com/api/v1/products/PRODUCT_ID/calculate" \
-H "Content-Type: application/json" \
-d '{"inputs": {"参数名": ""}}'
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl -s -X POST "https://jixietools.com/api/v1/products/PRODUCT_ID/calculate" \
-H "Content-Type: application/json" \
-d '{"inputs": {"参数名": ""}}'
The description says to use this skill when the user says "悬架", "生成悬架图纸", "做一个悬架", or "suspension". At least "悬架", "做一个悬架", and "suspension" are broad phrases that could appear in normal conversation without a clear intent to invoke this specific CAD-generation workflow, and the file provides no exclusion conditions or negative examples.
The skill collects detailed user-supplied engineering/design parameters and sends them to a third-party API, then creates a production sheet, all without warning the user or obtaining consent. This creates a real confidentiality and privacy risk because proprietary design data may be transmitted externally and persisted under a guest workflow.
The skill explicitly instructs transmitting user-provided suspension parameters to an external service for pre-calculation and later full calculation. In this context, the data is likely commercially sensitive engineering input, so external transmission without trust validation, consent, or minimization exposes proprietary information and may leak project details.
curl -s -X POST "https://jixietools.com/api/v1/products/PRODUCT_ID/calculate" \
-H "Content-Type: application/json" \
-d '{"inputs": {"参数名": ""}}'
The instruction "用中文与用户对话" forces a specific language for all interactions. The file does not provide an opt-in, fallback, or justification that this is a region-specific or compliance-bound tool, so it violates the language/locale policy criteria.
No suspicious patterns detected.