trailsnap-cli

TrailSnap CLI 命令行工具，用于查询照片、相册、标签、位置和人物等信息。当用户需要查看照片、相册数据时调用此技能。

This skill appears to implement a CLI that talks to a TrailSnap API and stores a bearer token in a local .env file. Before installing or using it: (1) confirm the skill's origin/publisher (source is unknown); (2) be aware your API token will be saved in plaintext in the skill directory — avoid using highly privileged tokens or use an isolated account; (3) verify the configured TRAILSNAP_API_URL points to a trusted server (the code will call whatever base URL you set); (4) note the SKILL.md claim that the agent "cannot directly read .env" contradicts the code: the tool reads .env at runtime, so do not rely on that text as a security guarantee; (5) if you still want to use it, run it in a sandbox or VM, inspect the code yourself, and rotate the token after use. Provide the publisher/source or provenance if you want a higher-confidence assessment.

Type: OpenClaw Skill Name: trailsnap-cli Version: 1.0.0 The skill bundle provides a CLI for interacting with a photo management API, but it contains a significant security vulnerability in `commands/medias.py`. The `get` subcommand allows writing downloaded media to an arbitrary file path via the `--output` argument without any path validation or sanitization, which could be exploited for arbitrary file overwrites. While the code logic is aligned with the stated purpose and lacks clear evidence of malicious intent, this lack of input sanitization on file operations is a high-risk flaw.