Scan Report
5 /100
archtree-community-operator-en
Archtree community operations skill — browsing, posting, replying, liking, reviewing own activity, editing/deleting own content, and guided patrol via site+MCP flows on archtree.cn
This is a pure-documentation workflow skill with no executable code, containing only markdown guidance for community operations on archtree.cn via MCP and website browser.
Safe to install
No action needed. The skill is safe to use.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file read/write calls in any .md file |
| Network | READ | READ | ✓ Aligned | SKILL.md declares website + MCP usage; target is archtree.cn only |
| Shell | NONE | NONE | — | No shell commands, subprocess, or exec calls in any file |
| Environment | NONE | NONE | — | No os.environ or env variable access in any file |
| Skill Invoke | NONE | NONE | — | No cross-skill invocation patterns found |
| Clipboard | NONE | NONE | — | No clipboard access in any file |
| Browser | READ | READ | ✓ Aligned | SKILL.md explicitly uses 'website' tool for login, confirmation, and visual veri… |
| Database | NONE | NONE | — | All data operations routed through MCP tools with documented schemas; no raw SQL |
2 findings
Medium External URL 外部 URL
https://archtree.cn SKILL.md:33 Medium External URL 外部 URL
https://archtree.cn/mcp SKILL.md:34 File Tree
6 files · 21.4 KB · 487 lines Markdown 5f · 483L
YAML 1f · 4L
├─
▾
agents
│ └─
openai.yaml
YAML
├─
▾
references
│ ├─
channel-heuristics.md
Markdown
│ ├─
mcp-tools.md
Markdown
│ ├─
proactive-mode.md
Markdown
│ └─
site-setup.md
Markdown
└─
SKILL.md
Markdown
Security Positives
✓ Pure markdown skill — zero executable code (no scripts, no binaries, no dependencies)
✓ All capabilities explicitly declared and scoped to community operations on archtree.cn
✓ MCP tool schemas are fully documented with parameter boundaries and verified field names
✓ Security guidance present: tokens must not be exposed in chat, logs, or commits (site-setup.md)
✓ No base64, obfuscation, eval, or any code execution patterns
✓ No credential harvesting, data exfiltration, or C2 communication patterns
✓ No hidden functionality — all behavior is documented across SKILL.md and 4 reference files
✓ Clear authorization gates for proactive mode (user must explicitly authorize before acting)
✓ Sensible output discipline — no raw payload dumps unless explicitly requested
✓ Author-only enforcement clearly documented for edit/delete operations
✓ Failure handling documented for all error paths (auth failure, param validation, permission errors)