Scan Report
5 /100
organizze
Node.js CLI scripts for the Organizze personal finance API
Legitimate Node.js CLI tool for the Organizze personal finance API with no malicious behavior detected.
Safe to install
No action required. This is a clean, well-documented API client skill.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Network | READ | READ | ✓ Aligned | src/client.js:3 - only contacts https://api.organizze.com.br/rest/v2 |
| Environment | READ | READ | ✓ Aligned | src/credentials.js:5-8 - reads ORGANIZZE_EMAIL, ORGANIZZE_TOKEN, ORGANIZZE_USER_… |
| Filesystem | NONE | READ | ✓ Aligned | src/credentials.js:1 - imports dotenv/config for .env reading; used only for loc… |
| Shell | NONE | NONE | — | No shell execution - only uses node process.argv for CLI dispatching |
8 findings
Medium External URL 外部 URL
https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen README.md:3 Medium External URL 外部 URL
https://img.shields.io/badge/%F0%9F%A6%9E-The%20Claw%20is%20The%20law-2ea44f?style=flat-square README.md:4 Medium External URL 外部 URL
https://clawhub.ai/leaofelipe/organizze-skill README.md:4 Medium External URL 外部 URL
https://app.organizze.com.br README.md:11 Medium External URL 外部 URL
https://app.organizze.com.br/configuracoes/api-keys README.md:27 Medium External URL 外部 URL
https://dotenvx.com package-lock.json:26 Medium External URL 外部 URL
https://api.organizze.com.br/rest/v2 src/client.js:3 Info Email 邮箱地址
[email protected] README.md:22 File Tree
13 files · 26.9 KB · 873 lines Markdown 4f · 436L
JavaScript 7f · 387L
JSON 2f · 50L
├─
▾
src
│ ├─
▾
routes
│ │ ├─
accounts.js
JavaScript
│ │ ├─
categories.js
JavaScript
│ │ ├─
credit-cards.js
JavaScript
│ │ ├─
transactions.js
JavaScript
│ │ └─
transfers.js
JavaScript
│ ├─
client.js
JavaScript
│ └─
credentials.js
⚠
JavaScript
├─
AGENTS.md
Markdown
├─
CLAUDE.md
Markdown
├─
package-lock.json
JSON
├─
package.json
JSON
├─
README.md
Markdown
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
dotenv | ^16.4.7 | npm | No | Pinned with caret range; no known CVEs |
Security Positives
✓ All network requests go exclusively to the legitimate Organizze API (https://api.organizze.com.br)
✓ Credentials are only used for HTTP Basic Auth with the legitimate API endpoint
✓ No credential exfiltration - tokens stay local and are sent only to the intended API
✓ No subprocess, shell commands, or code obfuscation
✓ No access to sensitive paths like ~/.ssh, ~/.aws, or other credential stores
✓ Documentation accurately describes all implemented functionality
✓ No hidden instructions, steganography, or suspicious patterns
✓ MIT-0 license, simple codebase with only one dependency
✓ dotenv dependency pinned to ^16.4.7 (no known vulnerabilities)