ApiTest

当用户需要从本地服务器获取工具数据时，调用 localhost:8080/gettool 接口获取工具信息。需要从环境变量 API_TEST_KEY 获取认证密钥。

Security Scan

The skill's stated purpose (call a local GET endpoint using an API_TEST_KEY) is coherent, but there are inconsistencies and behavioral choices — notably missing registry metadata for the required env var and broad auto-triggering — that could cause unexpected local calls or misuse of a sensitive token.

Purpose & Capability

The skill name/description match the runtime instructions: it will call http://localhost:8080/gettool and use an API_TEST_KEY from the environment. However, the registry metadata lists no required env vars while SKILL.md declares API_TEST_KEY as required/primary; this metadata mismatch is unexpected and should be corrected.

Instruction Scope

SKILL.md explicitly instructs the agent to read API_TEST_KEY and issue a GET to /gettool — that behavior is scoped. But auto_invoke is true with fairly broad trigger patterns (e.g., '调用.*接口' or '请求.*localhost'), which could cause the skill to run in contexts the user did not intend. Automatic reading of a sensitive environment variable and making network calls to localhost increases the chance of accidental exposure or unexpected interactions with local services.

Install Mechanism

No install spec and no code files — the skill is instruction-only and does not write files or download code. This is low-risk from an installation perspective.

Credentials

The only secret the skill needs is API_TEST_KEY, which is proportionate to calling an authenticated local API. That said, the registry metadata failing to declare this required env var is an inconsistency. Also the SKILL.md lists the credential scope as 'read-write' even though the skill performs a GET (read) operation — 'read' would be a more appropriate scope to request.

Persistence & Privilege

The skill does not request always:true and does not persist configuration or modify other skills. Autonomous invocation is enabled (normal), but combined with the broad triggers (see instruction_scope) this raises the main operational concern rather than a persistence/privilege issue.

What to consider before installing

Before installing: (1) note that this skill will read an environment variable (API_TEST_KEY) and automatically call http://localhost:8080/gettool when trigger patterns match — if that token is sensitive, avoid exposing it globally or consider using a least-privilege token. (2) Ask the author to fix registry metadata to declare API_TEST_KEY as a required env var and to set the credential scope to read-only if possible. (3) Consider disabling auto-invoke or narrowing the trigger patterns to avoid accidental invocations in unrelated conversations. (4) Ensure the local service on localhost:8080 is trusted (an attacker-controlled local service could return sensitive data). If these issues concern you and cannot be addressed, treat the skill as potentially risky and do not install it system-wide.

ApiTest Skill

当用户需要从本地服务器获取工具数据时，自动调用 http://localhost:8080/gettool 接口。

认证方式

本 skill 从环境变量 API_TEST_KEY 获取认证密钥，并在请求时使用 Bearer Token 认证。

请求格式:

curl -H "Authorization: Bearer ${API_TEST_KEY}" http://localhost:8080/gettool

触发条件

当用户提及以下内容时自动触发：

• "访问localhost获取工具"
• "获取工具数据"
• "调用 localhost:8080/gettool"
• 其他本地服务器工具获取请求

执行流程

1. 监听用户请求
2. 从环境变量 API_TEST_KEY 获取认证密钥
3. 调用 http://localhost:8080/gettool 接口，带上认证头
4. 返回获取到的工具数据

API 说明

• 接口地址: http://localhost:8080/gettool
• 请求方法: GET
• 认证方式: Bearer Token（从环境变量 API_TEST_KEY 获取）
• 请求头: Authorization: Bearer {API_TEST_KEY}
• 预期响应: 工具数据列表（JSON 格式）