Sano Intel · 探针资本

探针资本出品。中国医疗产业情报引擎，覆盖10万+医疗公司、50万+融资事件、109万条专利、全市场临床试验、A/港/美三地行情。查公司/融资/临床试验/专利/赛道热度/二级市场行情。By Probe Capital. Use when user asks about Chinese healthcare/biot...

Security Scan

The skill's instructions match its stated purpose but contain several inconsistencies and security concerns (an undeclared required token, use of a raw IP over plain HTTP, and an unverified token request link) that merit caution before use.

Purpose & Capability

The SKILL.md describes a Chinese healthcare intelligence API and the provided curl examples align with that purpose. However the skill metadata declares no required environment variables while the runtime instructions clearly require a SANO_TOKEN — this mismatch is concerning and indicates the manifest is incomplete or inaccurate.

Instruction Scope

Runtime instructions direct the agent to export and use a secret (SANO_TOKEN) and to call endpoints at http://47.102.196.1:8081 using curl with the token in the X-API-Key header. Using an IP address and plain HTTP means the token would be sent unencrypted over the network; the SKILL.md also points users to an external Feishu link to obtain a token. These are security and provenance risks beyond the normal scope of a query-only intelligence skill.

Install Mechanism

This is an instruction-only skill with no install steps and no code files, which minimizes install-time risk (nothing is written to disk).

Credentials

The only runtime secret the instructions require is SANO_TOKEN, which is proportionate for an API-based service. However the skill metadata does not declare any required env vars while the SKILL.md instructs users to set SANO_TOKEN — this inconsistency increases risk because automated permission checks or user prompts may not surface the need to protect/provide the token. Also, sending that token over HTTP to a bare IP is disproportionate from a security standpoint.

Persistence & Privilege

The skill does not request always: true and has no install behavior or claims to modify agent/system config. It does not request persistent elevated privileges.

What to consider before installing

Things to check before using this skill: - The SKILL.md asks you to set SANO_TOKEN, but the skill metadata doesn't declare it. Treat that as a red flag: the manifest should list required secrets. - The API base is an IP (47.102.196.1) served over HTTP. That means your token would be transmitted unencrypted; ask the publisher for an HTTPS endpoint and a domain name you can verify. - The token request link is an external Feishu share URL. Verify the link and the publisher's identity (Probe/探针资本) out-of-band before entering a token. - If you must test, use an ephemeral/restricted token and monitor outgoing network traffic. Do not reuse sensitive credentials. - Consider asking the skill author to: (1) update the manifest to declare SANO_TOKEN, (2) publish an HTTPS hostname and official API docs, and (3) explain hosting and data handling (especially given medical data/regulatory concerns). Given these issues, do not provide any production or high-privilege credentials until you have independent confirmation of the API's legitimacy and an HTTPS endpoint.

Sano Intel — 中国医疗产业情报引擎

探针资本出品，中国首个医疗产业情报 CLI，覆盖 10万+医疗公司、50万+融资事件、109万条专利、全市场临床试验、A/港/美三地二级市场行情。

首次使用

需要 API Token。申请地址：https://ffmp60ytnq.feishu.cn/share/base/shrcniDTJZknKba0LUeaF5BBuJg

拿到 Token 后配置：

export SANO_TOKEN=sk_你的token
# 或写入 ~/.zshrc 永久生效
echo 'export SANO_TOKEN=sk_你的token' >> ~/.zshrc

数据查询方式

所有查询通过 curl 调用 Sano Intel API，必须带上 X-API-Key: $SANO_TOKEN header。

API Base：http://47.102.196.1:8081

---

搜索公司

curl -s "http://47.102.196.1:8081/v1/search_companies" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keyword": "公司名或关键词", "limit": 10}'

公司详情

curl -s "http://47.102.196.1:8081/v1/company/恒瑞医药" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json"

融资事件

curl -s "http://47.102.196.1:8081/v1/search_financing" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"sector": "创新药", "stage": "B轮", "limit": 10}'

stage 可选：天使轮、Pre-A、A轮、A+轮、B轮、B+轮、C轮、D轮及以上、IPO

赛道热度

curl -s "http://47.102.196.1:8081/v1/sector_heat?top_n=10" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json"

返回各赛道融资事件数、公司数、总融资金额排行。

临床试验

curl -s "http://47.102.196.1:8081/v1/clinical_trials" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keyword": "PD-1", "phase": "三期", "limit": 10}'

二级市场行情

curl -s "http://47.102.196.1:8081/v1/market/600276" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json"

支持 A股（600276）、港股（1177.HK）、美股（MRNA）

每日情报摘要

curl -s "http://47.102.196.1:8081/v1/daily_digest?days=1&sectors=创新药" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json"

专利查询

curl -s "http://47.102.196.1:8081/v1/search_patents" \
  -H "X-API-Key: $SANO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keyword": "CAR-T", "limit": 10}'

支持参数：keyword（标题/摘要/申请人）、company_name（公司名）、sector（赛道）、status（专利状态）、limit（最多返回数，默认20）

---

使用原则

• 用户用中文提问时，自动判断意图选择合适接口
• 多个接口可组合使用：先看赛道热度，再看具体融资事件
• 返回结果用中文简洁总结，突出投资价值相关信息
• Token 未配置时，提示用户去 https://ffmp60ytnq.feishu.cn/share/base/shrcniDTJZknKba0LUeaF5BBuJg 申请

常见问法

用户问法	调用接口
今年创新药融了多少钱/哪些公司在融资	search_financing，sector=创新药
最热的医疗赛道是什么	sector_heat
帮我查XX公司	search_companies + company detail
PD-1相关临床试验进展	clinical_trials，keyword=PD-1
恒瑞今天股价	market，code=600276
今天医疗行业有什么重要新闻	daily_digest，days=1
最近B轮融资的医疗器械公司	search_financing，sector=医疗器械，stage=B轮
查CAR-T相关专利	search_patents，keyword=CAR-T
恒瑞的专利数量	search_patents，company_name=恒瑞医药