Security audit
Security checks across malware telemetry and agentic risk
The skill appears coherent for querying Insentek IoT data, but it needs review because stored API credentials can be sent to any configured API base URL.
Review before installing if the Insentek account contains sensitive operational data. Use only the default Insentek endpoint or a trusted test/self-hosted endpoint; do not set INSENTEK_API_BASE or --api-base to an untrusted host. Prefer interactive login instead of passing --secret on the command line, rotate credentials if they may have been exposed, and check export/report output paths before allowing file writes.
for k, v in headers.items():
req.add_header(k, v)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode("utf-8"))
except urllib.error.HTTPError as e:
body = e.read().decode("utf-8")req.data = json.dumps(data).encode("utf-8")
try:
with urllib.request.urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode("utf-8"))
except urllib.error.HTTPError as e:
# 认证失败，尝试刷新 token 后重试一次# 7. API 可达性（不带认证，只检查服务是否在线）
try:
req = urllib.request.Request(f"{api_base}/v3/token", method="GET")
with urllib.request.urlopen(req, timeout=10) as resp:
# 400 是正常的（缺少参数），说明服务在线
results["api_reachable"] = {
"ok": True,66/66 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.potential_exfiltration