shixinchao

测试-史新超

Security Scan

The skill claims to be a simple Q&A wrapper that uses an API key, but its metadata and code are inconsistent (missing declared env var, the script does not read the API_KEY, and streaming behavior is mishandled), so it is not internally coherent and needs fixes before trusting it.

Purpose & Capability

The SKILL.md and scripts indicate the skill is a thin client for the jointpilot async_chat API (Q&A/streaming). That purpose is reasonable for the declared functionality. However, the registry metadata lists no required environment variables while SKILL.md declares an API_KEY is required — a clear mismatch between what the skill says it needs and what the registry requests. This inconsistency suggests the package was not packaged correctly.

Instruction Scope

SKILL.md instructs the agent to call scripts/program.py and to read API_KEY from the environment, and it references an external endpoint (https://developer.jointpilot.com/...). Those instructions are within scope for a remote Q&A skill. The problem: the included script does not actually read the API_KEY from the environment (it sets api_key = ""), and the script calls requests.post with stream=False while parsing SSE lines — another implementation mismatch. These instruction/code inconsistencies mean the runtime behavior will not match the documented behavior and could leak or fail in unexpected ways.

Install Mechanism

No install spec is provided (instruction-only with a bundled script). This is low risk from an installation perspective because nothing arbitrary is downloaded at install time.

Credentials

SKILL.md requires a single sensitive env var (API_KEY) for bearer authentication to the external API — that is proportionate to the skill's purpose. However, the skill registry does not declare this required env var, and the program.py currently does not read the env var. The mismatch means user's API key may not be used as intended (or may be accidentally omitted), and the registry failing to declare the secret makes it easy to miss during review.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform privileges. Autonomous invocation is allowed (the platform default), which is normal for skills. No modifications to other skills or global agent settings are present.

What to consider before installing

This skill is suspiciously inconsistent rather than overtly malicious. Before installing or providing secrets: (1) Do not provide your real API key yet — the registry metadata does not declare API_KEY. (2) Inspect and fix the code: program.py currently sets api_key = "" instead of reading os.environ['API_KEY'] (or similar), so authentication will fail or send an empty bearer token. (3) Confirm streaming behavior: requests.post is called with stream=False while the code iterates response.iter_lines() expecting SSE; change to stream=True and handle SSE properly. (4) Remember that user questions (potentially sensitive) will be sent to the external domain developer.jointpilot.com; only use a scoped/test key and review the remote service's privacy policies. (5) If you are not the developer, ask the publisher to (a) update the registry metadata to declare API_KEY as required, (b) correct program.py to read the env var and handle streaming, and (c) document what data is sent to the external API. If these issues are not resolved, treat the skill as untrusted.

// turbo-all

测试-史新超

任务目标

• 本 Skill 用于：测试-史新超
• 能力包含：智能问答、上下文理解、流式输出
• 触发条件：用户提问时自动触发

前置准备

• 依赖说明：scripts 脚本所需的依赖包及版本

  requests==2.31.0
  

• 环境变量配置：

  • API_KEY：必需，API Key，用于调用接口

操作步骤

• 标准流程：

  1. 接收用户输入

     • 智能体接收用户提出的问题或指令
     • 示例：你好，请问有什么可以帮助你的？

  2. 调用脚本

     • 调用 scripts/program.py 处理问题
     • 必需参数：--question "用户输入文本"
     • 可选参数：根据应用配置动态生成
     • 脚本自动处理 API 调用和响应解析

  3. 返回结果

     • 脚本返回 API 的答案
     • 智能体将结果以清晰易懂的方式呈现给用户

资源索引

• 必要脚本：见 scripts/program.py
• API 参考：见 references/api_spec.md

注意事项

• API 调用使用流式输出，脚本会自动处理响应流
• API Key 从环境变量 API_KEY 读取，请确保已设置
• API 地址为 https://developer.jointpilot.com/v1/api/async_chat/completions/
• 请确保网络连接正常，API Key 有效
• 最后从返回值里获取答案

使用示例

示例 1：基本调用

python scripts/program.py --question "请介绍一下你的功能"

示例 2：完整调用

python scripts/program.py --question "帮我分析一下这个问题"