Local LRC Editor 专业LRC歌词创作工具

专业LRC歌词创作工具，支持歌曲音频波形可视化、歌词时间轴精准打点、LRC导入/导出、播放实时高亮、毫秒级时间戳编辑、自动本地存储防止数据丢失。前端使用jQuery+WaveSurfer.js开发，后端Python Flask，默认端口698，界面紧凑高效。使用场景：(1) 为歌曲制作LRC歌词文件 (2) 编辑...

This tool appears to be a legitimate local LRC editor, but exercise caution before running it: - Network exposure: The Flask app binds to 0.0.0.0 (all interfaces). If you run this on a machine connected to a network, others on that network could access the /upload and /shutdown endpoints. To limit exposure, edit web/app.py to use host='127.0.0.1' before launching. - Unauthenticated endpoints: /upload accepts files and saves them temporarily using the original filename (no secure_filename sanitization) — this can allow filename tricks and unexpected writes in the temp directory. Consider hardening by using werkzeug.utils.secure_filename and validating the saved path. - /shutdown is callable by any HTTP client that can reach the service; remove or protect it (e.g., require a token) if you plan to run on a networked host. - Automatic pip installs: start_server.py will pip install packages into the active Python environment. Run it inside a dedicated virtual environment (venv) to avoid contaminating your system Python and to inspect the packages before installation. - External JS CDN: the frontend loads jQuery and WaveSurfer from jsDelivr. If you need an offline or fully-audited install, vendor those scripts locally. - Run safely: run the skill on an isolated machine or container, inspect/modify the code as above (bind to localhost, sanitize filenames, protect shutdown), and prefer using a venv. If you want, I can show exact code changes to harden the app (change host, add filename sanitization, or protect the shutdown endpoint).

Type: OpenClaw Skill Name: xi-lrc-editor Version: 1.1.0 The skill is a functional LRC lyric editor, but it contains a path traversal vulnerability in `web/app.py` because it saves uploaded files using the unsanitized `file.filename` from the request. This could allow an attacker to overwrite or delete files outside the intended temporary directory. Additionally, `start_server.py` automatically executes `pip install` for several dependencies, which is a high-privilege action that introduces supply chain risks, although this behavior is documented in `SKILL.md`.