Ezer Multi-Agent Report Auditor

Wrapper skill for the Ezer audit backend API. Use this skill when the user asks to run a financial audit task by code/period/year/lang and return structured...

Security Scan

The skill's code, runtime instructions, and required environment variables align with its stated purpose (wrapping an Ezer audit backend API); there are no unexpected credentials, installs, or behaviors in the provided files.

Purpose & Capability

Name/description match the actual behavior: the script POSTs to /api/tasks and polls /api/tasks/{id}/result. Declared requirements (python3, EZER_API_BASE_URL) are exactly what the script needs.

Instruction Scope

SKILL.md instructs running the included Python script with the expected arguments and environment variable. The instructions and script only perform HTTP calls to the configured EZER_API_BASE_URL and do not read other files, system paths, or unrelated environment variables.

Install Mechanism

No install spec; the skill is instruction-only plus a small included script. Nothing is downloaded or extracted at install time. Required runtime binary is only python3, which is reasonable.

Credentials

Only EZER_API_BASE_URL is required and EZER_BEARER_TOKEN is optional. These are proportionate for an API wrapper. No unrelated secrets or many environment variables are requested.

Persistence & Privilege

always:false and default invocation behavior are set. The skill does not request persistent system privileges or modify other skills/config; it only makes outbound HTTP requests to the configured base URL.

Assessment

This skill appears to do exactly what it claims, but review these operational cautions before enabling it: 1) Ensure EZER_API_BASE_URL points to a trusted Ezer backend (prefer HTTPS) — the script will make network requests to whatever you set, including internal network addresses. 2) Only provide EZER_BEARER_TOKEN if necessary and treat it as a secret with least privilege; rotate it if exposed. 3) The script prints the full JSON response to stdout which may include sensitive data — consider where the output will be stored or forwarded. 4) If you need stronger isolation, run the skill in a restricted environment or network namespace. The included Python source is small and readable; review it yourself if you want to confirm there is no additional data exfiltration beyond contacting the configured API endpoints.

Ezer Audit API Skill

This skill wraps the existing Ezer backend API and returns task result payloads.

When to use

Use this skill when the user wants to run an Ezer audit task with these fields:

• code (example: 300750.SZ)
• period (FY|Q1|Q2|Q3|H1)
• year (integer)
• lang (example: zh-CN)

Required environment

• EZER_API_BASE_URL example: http://127.0.0.1:8008
• EZER_BEARER_TOKEN optional if API auth is disabled

Run command

python3 {baseDir}/scripts/invoke_ezer_api.py \
  --code 300750.SZ \
  --period FY \
  --year 2021 \
  --lang zh-CN

Behavior

1. POST /api/tasks to create task.
2. Poll /api/tasks/{task_id}/result until completion or timeout.
3. Print final JSON payload to stdout.

Notes

• This skill does not expose any model-provider keys.
• If the API returns failure, pass through error payload and non-zero exit.