ITSM 工单自动提交

This skill appears to implement the advertised automation but performs system-level operations and contains some inconsistencies you should review before installing. Recommendations: - Inspect submit-itsm.py fully to confirm whether it reads environment variables or uploads arbitrary files. Search for os.environ usage and any code that posts data to endpoints other than the ITSM host. - Do not run start.sh as root indiscriminately. The script may call sudo apt-get and pip; prefer running in a disposable VM or container to limit system impact. - Remove or replace hard-coded default credentials (500525 / Xy@123456) and supply credentials explicitly via the conversation or safe env injection. Confirm the code does not leak credentials to third parties. - Be aware that starting Chromium with --remote-debugging-port exposes a local CDP endpoint; ensure the port is not accessible remotely on your network and close the browser after use. - If you need to allow attachments, verify the attachment path handling and ensure no sensitive files are uploaded by default. If you want, I can: (1) scan submit-itsm.py for env access and network calls more thoroughly, (2) point out exact lines that set defaults or contact external URLs, or (3) suggest a safer wrapper that avoids automatic installs and requires explicit user consent for installs and network downloads.