今日水印相机-照片验真

The official Skill for Today's Watermark Camera (今日水印相机). This Skill makes HTTPS network requests strictly to the official domain (openapi.xhey.top) solely t...

This skill appears to do what it claims: it calls the official openapi.xhey.top endpoints using the provided GroupKey/GroupSecret and the Node runtime. Before installing, consider these practical checks: 1) Verify the npm package name (trutu-photo-verify-mcp) and the GitHub homepage are the official publisher and inspect the package on the npm registry (version checksum, maintainers). 2) Do not supply high-privilege or long-lived secrets for initial testing — use test keys and rotate them after verification. 3) Note that the bundled code logs request/response snippets and a context object; run it in an environment where console logs will not leak sensitive data (or remove/disable verbose debug logging). 4) Review the build artifacts (the included JS files) for unexpected network endpoints or obfuscated code (the repo contains a source map base64 block). 5) The skill runs a local Node process — run it with least privilege and in an isolated environment if you have sensitive data on the host. If you need greater assurance, ask the publisher for the npm package integrity (tarball checksum) or build from source after verifying the GitHub repository.