米游社工具

米游社工具插件。当用户消息包含以下任意关键词时触发：米游社登录、米游社绑定、米游社账号、米游社解绑、米游社任务、米游币任务、米游社签到、原神便笺、星铁便笺、开拓力、树脂、米游币商品、米游社兑换、米游社帮助、扫码补全stoken。支持短信登录、扫码登录、Cookie 登录三种方式。

This skill appears to do what it claims (MiYoShe login, tasks, sign-ins, and exchange) and includes working code that will run locally and contact official MiYoShe/Mihoyo endpoints. Key things to consider before installing or using it: - Sensitive data: You will be asked to paste cookies, stoken info or phone numbers. Those are saved unencrypted under skills/mystool/data/accounts.json and related files — treat these as high-risk secrets. - Trust the author: The skill has no homepage and an unknown source; review the code (especially src/api.py, runner.py, sms_login.py, and store.py) yourself before providing real credentials. - External proxy URL: If you configure a proxy (proxy_config.api_url), the skill will fetch data from that URL to get proxy IPs — that URL could be malicious or point to internal endpoints. Only set it to trusted services. - Automated actions: runner.py will run daily cron tasks and can iterate all stored accounts. If installed on a shared agent, it will act for every stored user account — consider isolation. - Deployment suggestions: run in an isolated/trusted environment, audit the full source (untruncated files), and test with a throwaway account first. If you must use real accounts, consider encrypting the data directory or avoiding storing long-lived cookies in this skill. If you want, I can highlight exact lines/places to inspect (e.g., where cookies are written, where external network calls occur) or scan the remaining truncated files for suspicious behavior.

Type: OpenClaw Skill Name: mystool Version: 0.1.1 The skill bundle is a comprehensive Miyoushe automation tool that handles sensitive user credentials, including cookies and login tokens. It contains a functional SSRF (Server-Side Request Forgery) vulnerability in 'src/sms_login.py' via the '_get_proxy' function, which performs unvalidated HTTP GET requests to a user-provided URL. Additionally, the tool implements a cross-platform account sharing mechanism in 'src/store.py' ('merge_user_accounts') that allows transferring sensitive session data between users via 6-digit codes. While these features are documented as intended for power users, the combination of credential handling, local storage of cookies in 'data/accounts.json', and the SSRF risk warrants a suspicious classification.