Security checks across malware telemetry and agentic risk
The skill mostly matches its IoT data-query purpose, but it has enough credential-routing and documentation-scope issues that users should review it before installing.
Install only if you trust the Insentek publisher and need this specific IoT integration. Configure credentials only through the CLI login flow, do not paste appid or secret into chat, avoid setting INSENTEK_API_BASE or --api-base unless you fully trust the target server, and treat the bundled write/forwarding API docs as sensitive operations requiring explicit human review.
req.data = json.dumps(data).encode("utf-8")
try:
with urllib.request.urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode("utf-8"))
except urllib.error.HTTPError as e:
# 认证失败，尝试刷新 token 后重试一次# 7. API 可达性（不带认证，只检查服务是否在线）
try:
req = urllib.request.Request(f"{api_base}/v3/token", method="GET")
with urllib.request.urlopen(req, timeout=10) as resp:
# 400 是正常的（缺少参数），说明服务在线
results["api_reachable"] = {
"ok": True,65/65 vendors flagged this skill as clean.