蛋叔订单商品查询

当用户需要查询蛋糕订单信息时使用此技能。通过输入订单号，调用内部API查询对应的蛋糕商品名称。此技能应在下述情况时使用：用户询问"查订单"、"订单查询"、"蛋糕订单"、"查蛋糕"、或直接提供订单号要求查询。技能会自动组装API请求并解析返回结果，提取商品名称返回给用户。

Security Scan

The skill is internally consistent: it only describes extracting an order ID from user input and calling a single cake-order API endpoint, and it does not request extra credentials, installs, or unrelated system access.

Purpose & Capability

The name/description (query cake order by order number) matches the instructions: the SKILL.md only needs to assemble a GET request to a single orders API and parse the response. No unexpected binaries, credentials, or config paths are requested.

Instruction Scope

Runtime instructions are narrowly scoped: extract an order_id from the user input, call https://trade.dangaoss.cn/cake_api/ck_orders?order_id={id}, check code==200 and return data or msg. The instructions do not ask the agent to read files, other environment variables, or transmit unrelated data.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing will be written to disk during install. Low install risk.

Credentials

The skill declares no required environment variables or credentials, which is consistent with the SKILL.md statement that the endpoint is in 'test mode' and requires no auth. No unrelated secrets are requested.

Persistence & Privilege

always is false and the skill is user-invocable/autonomously callable by default. It does not request persistent system changes or configuration writes and does not claim elevated privileges.

Assessment

This skill appears coherent and low-risk, but consider these practical checks before installing: 1) Confirm the API domain (trade.dangaoss.cn) is a trusted internal or partner endpoint—the skill will send user-provided order numbers to that server. 2) Verify privacy rules: order IDs or associated PII may be transmitted; ensure that sending them to this endpoint is acceptable. 3) The SKILL.md says the API needs no authentication (test mode); ask the provider if production requires credentials or if behavior will change. 4) Ensure your platform validates TLS certificates for that host. 5) Because the skill is instruction-only, the code isn’t present for review — if you need higher assurance, ask the publisher for an endpoint SLA, example traffic, or a signed manifest. If any of these checks fail or you don’t recognize the domain, treat the skill as untrusted and do not enable it.

蛋糕叔叔订单商品查询技能

技能概述

本技能用于通过订单号查询蛋糕商品名称，调用企业内部蛋糕订单系统API获取信息。

使用场景

• 用户说"帮我查一下订单"
• 用户说"订单查询"
• 用户说"蛋糕订单"
• 用户说"查蛋糕"
• 用户直接提供订单号要求查询

API 接口信息

接口地址： https://trade.dangaoss.cn/cake_api/ck_orders

请求方式： GET

请求参数：

参数名	类型	必填	说明
order_id	string	是	订单号

示例请求：

GET https://trade.dangaoss.cn/cake_api/ck_orders?order_id=43

响应格式

成功响应示例：

{
    "code": 200,
    "msg": "获取成功",
    "data": "蓝莓千层拿破仓 Blueberry Mille-feuilles"
}

响应字段说明：

字段	类型	说明
code	int	状态码，200表示成功
msg	string	响应消息
data	string	蛋糕商品名称

执行流程

1. 提取订单号：从用户输入中识别订单号
2. 调用API：使用 https://trade.dangaoss.cn/cake_api/ck_orders?order_id={订单号} 获取数据
3. 解析响应：判断 code 是否为 200
4. 返回结果：
   • 成功时，返回商品名称
   • 失败时，返回错误消息（msg字段）

示例对话

用户： "帮我查一下订单43"

助手： "订单43对应的蛋糕是：蓝莓千层拿破仓 Blueberry Mille-feuilles"

用户： "查蛋糕订单"

助手： "请提供您要查询的订单号"

用户： "订单号是88"

助手： "订单88对应的蛋糕是：草莓慕斯蛋糕 Strawberry Mousse Cake"

注意事项

• 当前接口无需认证（测试模式）
• 订单号必须是有效数字
• 如返回非200状态码，直接展示 msg 中的错误信息