Sano Intel · 探针资本

探针资本出品。中国医疗产业情报引擎，覆盖10万+医疗公司、50万+融资事件、109万条专利、全市场临床试验、A/港/美三地行情。查公司/融资/临床试验/专利/赛道热度/二级市场行情。By Probe Capital. Use when user asks about Chinese healthcare/biot...

Things to check before using this skill: - The SKILL.md asks you to set SANO_TOKEN, but the skill metadata doesn't declare it. Treat that as a red flag: the manifest should list required secrets. - The API base is an IP (47.102.196.1) served over HTTP. That means your token would be transmitted unencrypted; ask the publisher for an HTTPS endpoint and a domain name you can verify. - The token request link is an external Feishu share URL. Verify the link and the publisher's identity (Probe/探针资本) out-of-band before entering a token. - If you must test, use an ephemeral/restricted token and monitor outgoing network traffic. Do not reuse sensitive credentials. - Consider asking the skill author to: (1) update the manifest to declare SANO_TOKEN, (2) publish an HTTPS hostname and official API docs, and (3) explain hosting and data handling (especially given medical data/regulatory concerns). Given these issues, do not provide any production or high-privilege credentials until you have independent confirmation of the API's legitimacy and an HTTPS endpoint.

Type: OpenClaw Skill Name: sano-intel Version: 1.0.0 The skill provides a healthcare industry intelligence engine but is classified as suspicious due to the use of unencrypted HTTP for API calls (http://47.102.196.1:8081) in SKILL.md, which transmits the SANO_TOKEN in plain text. Additionally, it encourages users to store this token in their shell configuration files (~/.zshrc). While the functionality aligns with the stated purpose, these practices represent significant security vulnerabilities that could lead to credential theft via network interception.