xiaojia-skills

Before installing or using this skill: - Expect to set JUSTAI_OPENAPI_BASE_URL and JUSTAI_OPENAPI_API_KEY in your environment; the code will exit if they're not present even though the registry metadata doesn't list them. This mismatch is likely an oversight but you should be aware. - The scripts will send your prompts, conversation_id, and any provided project_id/skill_id to the configured base URL. Only use a base URL and API key you trust (preferably a well-audited internal or vendor endpoint). - Inspect the bundled scripts (they are small and readable) before running them in a sensitive environment. They use urllib to POST JSON; no other hidden network calls or file exfiltration are present in the code. - Limit the scope of the API key you provide (use least privilege) and avoid putting broad or long-lived org-level keys into this skill if possible. - Because the source/homepage is unspecified in the registry, consider installing from the upstream repository referenced in README (verify its authenticity) or obtain the code via a verified source. - If you need stricter controls, run the scripts in an isolated environment/container or use a proxy to monitor outbound requests to the configured base URL. If you want, I can list the exact lines that require the env vars and the network endpoints the scripts will call.