Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed report-research helper that uses the fxbaogao API and local Markdown templates, with no hidden persistence or destructive behavior found.
Install only if you intend to use fxbaogao for report research and are comfortable sending search terms, organization filters, and report IDs to its API using your FXBAOGAO_API_KEY. Review downloaded PDFs and generated Markdown outputs as research material, not verified ground truth.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.idea
.env
.DS_Store
__pycache__/
*.pyc
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
示例：
curl -X POST "https://api.fxbaogao.com/mofoun/agent/search" \
-H "Authorization: Bearer $FXBAOGAO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"keywords":"光模块 800G AI算力","orgNames":[],"endTime":"last1year"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
示例：
curl -X POST "https://api.fxbaogao.com/mofoun/agent/search" \
-H "Authorization: Bearer $FXBAOGAO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"keywords":"光模块 800G AI算力","orgNames":[],"endTime":"last1year"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
示例：
curl -X POST "https://api.fxbaogao.com/mofoun/agent/search" \
-H "Authorization: Bearer $FXBAOGAO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"keywords":"光模块 800G AI算力","orgNames":[],"endTime":"last1year"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
示例：
curl -X POST "https://api.fxbaogao.com/mofoun/agent/search" \
-H "Authorization: Bearer $FXBAOGAO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"keywords":"光模块 800G AI算力","orgNames":[],"endTime":"last1year"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
示例：
curl -X POST "https://api.fxbaogao.com/mofoun/agent/paragraph" \
-H "Authorization: Bearer $FXBAOGAO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"reportId":5339478,"keyword":"光模块 800G"}'
This playbook is entirely authored in Chinese and provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file contains all user-facing procedural guidance in Chinese, and nowhere indicates that the user may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
The usage section presents only Chinese natural-language trigger phrases, which effectively constrains invocation to a specific language. Because the document does not state that other languages are supported or provide a user language choice, this can be read as a language/locale restriction without opt-in.
This markdown template presents all headings and instructions in Chinese and does not indicate that users may choose another language. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation.