Industrial Silicon Army

产业互联网硅基军团 - 面向制造业的Multi-Agent运营系统，涵盖采购/生产/销售/研发/合规全链路

Security Scan

The skill appears to implement a legitimate manufacturing multi-agent system, but there are multiple inconsistencies (declared env/deps vs package files, provenance/licensing ambiguities) that merit caution before installation and use.

Purpose & Capability

The code (FastAPI server + 20 agents) matches the stated purpose (a multi-agent industrial operations platform). Requesting an LLM key (implied by langgraph / CHIEF orchestration) would be proportionate. However the registry metadata at the top claims no required env vars while clawhub.yaml declares OPENAI_API_KEY as required — this mismatch reduces trust in the declarations and documentation coherence.

Instruction Scope

SKILL.md and README give normal run instructions (pip install -r requirements.txt; run api_server.py / industrial_agents.py). The SKILL.md prose does not instruct the agent to read arbitrary system files or exfiltrate secrets. That said, the runtime code references a CHIEF executor (LangGraph/LLM orchestration) which will almost certainly call external LLM services; the SKILL.md does not clearly document what data is sent to external services or how sensitive fields are handled.

Install Mechanism

No remote download/install URL or archive extraction is used — the package is instruction-only and uses pip-installable Python packages listed in requirements.txt / package.json. This is a low-to-moderate install risk typical for Python projects.

Credentials

There is an inconsistency between top-level registry metadata (which lists no required env vars) and clawhub.yaml (which requires OPENAI_API_KEY as primary_env). package.json and requirements.txt include langgraph, httpx, and other LLM-related deps, implying external LLM credentials are needed — that is plausible for the skill, but the mixed/contradictory declarations are concerning. The skill would require at least an LLM API key (sensitive), and documentation does not state how data is protected or where it is sent. Also license fields differ (MIT vs MIT-0) and the package/homepage/source information is incomplete, weakening provenance.

Persistence & Privilege

The skill does not request always:true or other elevated platform privileges. It runs as a local FastAPI service and does not declare persistent platform-level modifications. Autonomous invocation (disabled-model-invocation=false) is the platform default and is not by itself a red flag.

What to consider before installing

What to watch for before installing: - Provenance: the package has no clear trusted homepage and the owner ID is opaque. Ask the publisher for a public repository link with commit history and a contact you can verify before trusting production data. - Environment credentials: clawhub.yaml requires OPENAI_API_KEY (sensible for a LangGraph/LLM-backed orchestrator). Confirm where LLM calls are directed (OpenAI, other providers): inspect CHIEF.execute and any network calls in industrial_agents.py for endpoints and what data is sent. Only provide API keys with least privilege and consider using a non-production/test key first. - Dependency/metadata mismatches: SKILL.md frontmatter, requirements.txt, and package.json are inconsistent (langgraph appears required but is not listed in SKILL.md frontmatter). Confirm the exact runtime dependencies and test install in an isolated environment. - Data exfiltration and privacy: the system routes business data to agents and likely to external LLMs; confirm whether any logs or telemetry are sent to third parties and whether sensitive PII or proprietary BOM/pricing data is sanitized before transmission. - License and support: license fields differ (MIT vs MIT-0) and the published contact/website should be validated. Ask for a signed CLA / enterprise contract for private deployments if you plan to run on company data. Recommended steps before deployment: 1) Review the full CHIEF/agent source (search for HTTP calls, external endpoints, os.environ usage) and confirm handling of OPENAI_API_KEY. 2) Run the service in a network-isolated sandbox and test with dummy data. 3) Provide a scoped/test LLM API key and monitor outbound traffic. 4) Require the author to clarify metadata (required env vars, dependencies, license, repo) and provide verifiable contact/organization details. 5) Only allow production secrets after code provenance and telemetry/privacy behavior are confirmed. If the publisher supplies a canonical public repo with clear commit history and documentation showing explicit LLM provider endpoints and data-handling policies, confidence in this skill would increase.

产业互联网硅基军团 SKILL.md

一、系统定位

面向制造业的产业互联网AI运营平台，模拟一个完整的制造业中层管理团队。

LookingPlas（塑化行业）为核心行业，后续可扩展至模具/化工/电子/汽车零部件。

二、团队架构

幕僚长（ChiefOfStaff）

• 任务分发、调度、结果整合
• 支持自然语言查询全链路数据
• 主动预警异常

核心执行Agent（20个）

采购与供应链（4个）

Agent	职能	关键能力
原料采购Agent	供应商匹配/行情分析/下单	1688/阿里巴巴比价
仓储管理Agent	库存预警/库位优化	实时库存 + 安全库存
物流调度Agent	车队匹配/路线优化	降低物流成本
供应商管理Agent	评级/风控/合同	供应商KPI

生产与研发（4个）

Agent	职能	关键能力
生产调度Agent	排产/工单管理	交期承诺
配方研发Agent	新材料/替代料	成本优化
质量检测Agent	来料/过程/成品	合标率
设备维护Agent	预测性维护	减少停机

销售与市场（4个）

Agent	职能	关键能力
报价Agent	快速响应/成本叠加	提升响应速度
订单履约Agent	订单跟踪/异常处理	客户满意度
客户管理Agent	客户分级/跟进	复购率
竞品监控Agent	市场价格/替代品	定价决策

财务与合规（4个）

Agent	职能	关键能力
成本核算Agent	实际成本/标准成本	毛利分析
合规审查Agent	环保/安全/税务	减少处罚
风险预警Agent	客户信用/材料波动	降低坏账
政策解读Agent	行业政策/补贴	争取优惠

通用运营（4个）

Agent	职能	关键能力
数据分析Agent	经营日报/月报	BI报表
报告生成Agent	会议纪要/汇报材料	减少文山
项目管理Agent	里程碑/风险/进度	交付透明
客服支持Agent	售后/投诉/FAQ	响应<4h

三、行业Know-How（塑化行业）

核心业务流程

原料采购 → 来料检测 → 生产排产 → 质量控制 → 成品入库
    ↓                                           ↓
客户询价 ← 报价响应 ← 订单评审 ← 交期确认   物流发货

关键KPI

指标	目标
原料库存周转	≥12次/年
来料合格率	≥98%
交期达成率	≥95%
产品合格率	≥99.5%
毛利率	≥20%
客户复购率	≥60%

四、技术实现

架构

• ChiefOfStaff = LangGraph 状态机
• 各Agent = Python async 函数
• API层 = FastAPI
• 数据源 = ERP/MES/WMS/CRM API

关键词路由表

关键词	Agent
原料/供应商/行情/比价	原料采购Agent
库存/库位/周转	仓储管理Agent
排产/工单/交期	生产调度Agent
配方/新材料/成本	配方研发Agent
质量/检测/合格率	质量检测Agent
设备/维修/停机	设备维护Agent
报价/价格/成本	报价Agent
订单/发货/交期	订单履约Agent
客户/跟进/复购	客户管理Agent
竞品/市场/定价	竞品监控Agent
成本/毛利/利润	成本核算Agent
合规/环保/安全	合规审查Agent
风控/预警/呆账	风险预警Agent
政策/补贴/税务	政策解读Agent
数据/报表/月报	数据分析Agent
报告/会议/文档	报告生成Agent
项目/里程碑/进度	项目管理Agent
售后/投诉/客服	客服支持Agent