中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 0/100
上次扫描：2 天前 重新扫描
0 /100
usememos-api
Interact with UseMemos instance — create, search, list memos and upload attachments
UseMemos API skill is a straightforward, legitimate self-hosted memo service client with no malicious behavior detected.
技能名称usememos-api
分析耗时38.2s
引擎pi
✓
可以安装
This skill is safe to use. No security concerns identified.
资源类型声明权限推断权限状态证据
环境变量 READ READ ✓ 一致 SKILL.md declares USEMEMOS_URL and USEMEMOS_TOKEN; load_env.py reads from .env
网络访问 READ READ ✓ 一致 All scripts make HTTP requests to USEMEMOS_URL only
文件系统 READ READ ✓ 一致 Only reads files for upload (upload_attachment.py line 31)
命令执行 NONE NONE — No subprocess calls in production scripts
技能调用 NONE NONE — No cross-skill invocation
4 项发现
🔗
中危 外部 URL 外部 URL
https://openclaw.ai
README.md:3
🔗
中危 外部 URL 外部 URL
https://usememos.com
README.md:3
🔗
中危 外部 URL 外部 URL
http://192.168.0.157:5230
SKILL.md:25
🔗
中危 外部 URL 外部 URL
https://your-memos-instance.com/api/v1
references/api.md:3

目录结构

12 文件 · 39.9 KB · 1365 行
Python 8f · 876L Markdown 4f · 489L
├─ ▾ 📁 references
│ └─ 📝 api.md Markdown 200L · 3.0 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 create_memo.py Python 57L · 1.5 KB
│ ├─ 🐍 list_memos.py Python 68L · 1.9 KB
│ ├─ 🐍 load_env.py Python 26L · 805 B
│ ├─ 🐍 memo_comments.py Python 135L · 4.4 KB
│ ├─ 🐍 search_memos.py Python 67L · 1.9 KB
│ ├─ 🐍 upload_and_link_attachment.py Python 119L · 3.7 KB
│ └─ 🐍 upload_attachment.py Python 68L · 2.0 KB
├─ ▾ 📁 tests
│ └─ 🐍 test_image_upload.py Python 336L · 12.4 KB
├─ 📝 CHANGELOG.md Markdown 35L · 1.2 KB
├─ 📝 README.md Markdown 170L · 4.1 KB
└─ 📝 SKILL.md Markdown 84L · 2.9 KB

安全亮点

✓ Uses only Python standard library (urllib.request, json, os, sys, base64) - no external dependencies
✓ Credentials (USEMEMOS_TOKEN) are only used for Bearer authentication to the configured self-hosted instance
✓ No credential harvesting or exfiltration detected
✓ No shell execution in main production scripts (subprocess only in tests for testing purposes)
✓ No base64-decoded shell execution, no obfuscated code, no hidden instructions
✓ All network requests target the user-configured USEMEMOS_URL only
✓ File access is limited to reading files explicitly passed as arguments for upload
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env, etc.)
✓ Input sanitization present (query escaping in search_memos.py)