APM 메시지 푸시 API

APM 플랫폼의 메시지 푸시 서비스 API 모음. 헬스 체크, 관리자/사용자 푸시 메시지 목록·상세·읽음 상태 업데이트, 커스텀 정보 업로드 등 8개 엔드포인트를 포함. authcode 헤더(HH + access_token)로 호출. 서비스명: ApmZoomPushMessageSe...

Security Scan

The skill is an instruction-only API wrapper for an APM push-message service and its declared requirements (a single APM_USER_TOKEN) and instructions are consistent with that purpose.

Purpose & Capability

Name/description match the files and runtime instructions. The only credential requested is APM_USER_TOKEN which is appropriate for calling a protected API. No unrelated binaries, config paths, or extra services are requested.

Instruction Scope

SKILL.md documents the endpoints, required headers, and per-endpoint signing (MD5(params + salt)). It instructs the agent to use an access_token stored in APM_USER_TOKEN as the auth header. The instructions do not ask the agent to read unrelated files or exfiltrate data. Minor note: the recommended method to obtain access_token is referenced vaguely as "ids_*_login_*", so the source/procedure for obtaining the token is not fully specified and must be handled outside the skill.

Install Mechanism

Instruction-only skill with no install spec and no code files; nothing is written to disk by the skill itself.

Credentials

Only one environment variable (APM_USER_TOKEN) is required and explicitly used as the auth token. This is proportional for a service API wrapper. Users should ensure the token provided has appropriate (least) privileges.

Persistence & Privilege

always:false and standard model invocation allowed. The skill does not request persistent system presence or modify other skill/system configs.

Assessment

This skill is an API documentation/wrapper and will use the APM_USER_TOKEN value as the auth header when calling the listed base URL. Before installing: 1) Only supply an access token with the minimum required scope (do not reuse admin or cloud-provider secrets). 2) Verify you trust the base URL (https://44k2t5n59e.execute-api.ap-northeast-2.amazonaws.com) and the upstream project link. 3) Note the skill expects you to obtain a token outside the skill (the guidance to get a token is vague); confirm how you will generate or rotate that token. 4) If you plan to store the token in CI or shared environments, treat it as a secret and follow your org's secret-management practices.

APM 플랫폼의 메시지 푸시 서비스 API 모음. 헬스 체크, 관리자/사용자 푸시 메시지 목록·상세·읽음 상태 업데이트, 커스텀 정보 업로드 등 8개 엔드포인트를 포함. authcode 헤더(HH + access_token)로 호출. 서비스명: ApmZoomPushMessageService.

공통 규약

• Base URL: https://44k2t5n59e.execute-api.ap-northeast-2.amazonaws.com
• 요청 헤더: v=7.0.1, p=1, t=<unix초>, lang=zh-cn
• 인증 헤더: authcode: "HH " + access_token (로그인 계열 제외)
• 서명: sign = MD5(<params> + <salt>).toUpperCase() — 엔드포인트별 salt는 각 문서 참조
• 성공 코드: code=100, 결과는 result 필드
• 페이지네이션: last_update_time 커서 방식, page_size=20

엔드포인트 목록 (8개)

• pms_health — 메시지 푸시 서비스 헬스 체크 · GET /pms/health
• pms_m_editpushmsgreadstatus — 메시지를 읽음으로 변경[판매자] · POST /pms/app/m_editpushmsgreadstatus
• pms_m_pushmsginfo — 홈 공지 정보 조회[판매자] · GET /pms/app/m_pushmsginfo
• pms_m_pushmsglist — 공지 목록 조회[판매자] · GET /pms/app/m_pushmsglist
• pms_u_editpushmsgreadstatus — 메시지를 읽음으로 변경[사용자] · POST /pms/app/u_editpushmsgreadstatus
• pms_u_pushmsginfo — 홈 공지 정보 조회[사용자] · GET /pms/app/u_pushmsginfo
• pms_u_pushmsglist — 공지 목록 조회[사용자] · GET /pms/app/u_pushmsglist
• pms_uploadcustominfo — 커스텀 정보 업로드 · POST /pms/app/uploadcustominfo

사용법

1. 필요한 엔드포인트 문서를 확인 (파일명 = 엔드포인트 이름)
2. ids_*_login_* 중 하나로 access_token 획득 (APM_USER_TOKEN 환경변수에 저장)
3. 요청 헤더에 authcode: "HH " + $APM_USER_TOKEN 추가
4. 해당 문서의 서명 규칙에 따라 sign 계산 후 호출

원본 문서: https://github.com/apmzoom-ai/apm-skills