Security audit
Security checks for vulnerabilities and agentic risk
This skill is an internal API helper, but it can change company records and stores sensitive login material locally, so it should be reviewed before use.
Install only if you trust the configured API endpoint and are comfortable giving this skill your internal platform API keys, login password, and authority to create company records. Prefer a least-privilege or test account, verify the base URL carefully, keep the generated config and token files out of shared or synced folders, and treat project-add, task-add, and product-add as production-changing commands.
if [ "$(date +%s)" -lt "$exp" ] && [ -n "$t" ]; then echo "$t"; return 0; fi
fi
local r; r=$(curl -s -X POST "$base_url/open/auth/login" \
-H "Content-Type: application/json" \
-d "{\"access_key\":\"$ak\",\"secret_key\":\"$sk\"}")
local s; s=$(echo "$r" | jq -r '.status')do_login() {
local api_base; api_base=$(jq -r '.base_url // ""' "$CONFIG_FILE" 2>/dev/null)
load_config
local r; r=$(curl -s -X POST "${api_base}/ent/user/login" \
-H "accept: application/json" -H "content-type: application/json" \
-H "user-agent: Mozilla/5.0" \
-d "{\"account\":\"$ACCOUNT\",\"password\":\"$PASSWORD\"}")echo "正在验证...请稍候"
# 先尝试开放平台登录
local r; r=$(curl -s -X POST "$base_url/open/auth/login" -H "Content-Type: application/json" -d "{"access_key":"$ak","secret_key":"$sk"}")
local s; s=$(echo "$r" | jq -r '.status')
if [ "$s" = "200" ]; then
echo "✅ 开放平台验证通过"fi
# 尝试用户登录
r=$(curl -s -X POST "$base_url/ent/user/login" -H "accept: application/json" -H "content-type: application/json" -H "user-agent: Mozilla/5.0" -d "{"account":"$acct","password":"$pwd"}")
s=$(echo "$r" | jq -r '.status')
if [ "$s" = "200" ]; then
echo "✅ 用户登录验证通过"No suspicious patterns detected.