MaxKB

查询已发布智能体列表供 LLM 选择，再按指定智能体名称发起对话并返回回答。

Security Scan

The skill's code and docs legitimately require MaxKB credentials and configuration, but the registry metadata does not declare any required environment variables—this mismatch and missing provenance are concerning.

Purpose & Capability

The skill's name/description (listing published agents and forwarding a question to a named agent) matches the implementation: the script queries a MaxKB instance and opens chat sessions. However, the registry metadata declares no required environment variables or credentials, while the SKILL.md and scripts clearly require MAXKB_DOMAIN and either MAXKB_TOKEN or MAXKB_USERNAME/MAXKB_PASSWORD (and optionally MAXKB_API_PREFIX and MAXKB_WORKSPACE_ID). The absence of these declarations in the registry is an incoherence and should be clarified.

Instruction Scope

Runtime instructions are focused: run the included Python script which reads a local .env (if present) and environment variables, then makes HTTP(S) calls to the MaxKB domain (login, list applications, obtain access token, create anonymous session, post chat messages). The instructions do not attempt to read unrelated system files or exfiltrate data to third-party endpoints beyond the configured MAXKB_DOMAIN.

Install Mechanism

This is an instruction-only skill with a single Python script; there is no install spec that downloads or executes arbitrary external code. The script embeds a lightweight .env loader to avoid optional dependency on python-dotenv.

Credentials

The script legitimately needs MAXKB_DOMAIN and either a token or username/password to authenticate to the MaxKB instance. Those environment variables are documented in SKILL.md/README but were not declared in the registry's required env list—this mismatch is a material oversight. The set of env vars requested by the script is otherwise proportional to the stated purpose and does not request unrelated cloud credentials.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide settings, and only reads a .env in its own skill directory. It does not persist credentials beyond using environment variables and runtime HTTP calls.

What to consider before installing

This skill's behavior (querying a MaxKB server, logging in, obtaining access tokens, and opening chat sessions) matches its description, but the registry metadata incorrectly claims no required environment variables while the code requires MAXKB_DOMAIN plus either MAXKB_TOKEN or MAXKB_USERNAME/MAXKB_PASSWORD. Before installing: 1) Only provide credentials for a MaxKB instance you trust; the skill will send user questions to that server. 2) Prefer a scoped/limited token over admin credentials if possible. 3) Run the script in an isolated environment first (or inspect/modify the code) to confirm the endpoints (MAXKB_DOMAIN and any API prefix) and to ensure logs/outputs do not leak secrets. 4) Ask the publisher to correct the registry metadata to list the required env vars and to provide a homepage/source provenance. 5) If you cannot verify the MaxKB instance or the publisher, do not supply real credentials.

chat_to_agents — 智能路由与调用

功能描述

本 Skill 提供两个工具函数，配合宿主智能体的 LLM 完成路由与调用：

函数	作用
list_agents	返回所有已发布智能体的 name 和 desc，供 LLM 判断选择
chat_to_agent	按 LLM 指定的 agent_name 调用对应智能体，返回回答

推荐调用流程

用户提问
   │
   ▼
LLM 调用 list_agents()          ← 获取智能体列表
   │  返回 [{"name":..., "desc":...}, ...]
   ▼
LLM 根据问题选出最合适的 agent_name
   │
   ▼
LLM 调用 chat_to_agent(question, agent_name)  ← 发起对话
   │  返回 {"agent_name":..., "answer":...}
   ▼
将 answer 返回给用户

list_agents

python3 scripts/main.py 

无需参数，返回 JSON 数组：

[
  {"name": "客服助手", "desc": "处理用户常见问题"},
  {"name": "代码助手", "desc": "辅助编写和审查代码"}
]

chat_to_agent

python3 scripts/main.py <question> <agent_name>

参数	类型	说明
question	string	用户的问题文本
agent_name	string	由 LLM 从 list_agents 结果中选定的名称

返回 JSON 字符串：

字段	类型	说明
agent_name	string	实际调用的智能体名称
answer	string	智能体的回答内容

示例：

{
  "agent_name": "客服助手",
  "answer": "您好，有什么可以帮助您的？"
}

环境变量

变量	说明	默认值
MAXKB_DOMAIN	MaxKB 服务地址	<maxkb_domain>
MAXKB_TOKEN	Bearer Token（管理员 API Key）	—
MAXKB_WORKSPACE_ID	工作空间 ID	default
MAXKB_USERNAME	登录用户名（优先于 TOKEN）	—
MAXKB_PASSWORD	登录密码（优先于 TOKEN）	—