Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a disclosed WorkBuddy usage-dashboard tool with local report generation, local archiving, and an optional user-supplied WorkBuddy billing API check.
Install only if you want a local WorkBuddy usage report. Treat generated HTML, JSON, JS, CSV, and archive files as private because they can contain session titles, error snippets, and up to 300 characters of prompt text. Do not use --billing-token-file unless you intentionally want the skill to send your manually copied WorkBuddy session credential to workbuddy.cn for billing data, and delete or invalidate that token file afterward.
python3 scripts/usage_extractor.py [--out <输出目录>] [--home <数据根>] [--credit-xlsx <路径>] [--billing-token-file <路径>] [--seed <旧快照>] [--no-archive]
- `chart.umd.min.js` —— 图表引擎，由抽取器从 skill 包复制到输出目录，需与 HTML 同目录存放。
- `chart.umd.min.js` —— 图表引擎，由抽取器从 skill 包复制到输出目录，需与 HTML 同目录存放。
<meta charset="UTF-8" data-page-node-id="uh7S5G2MLok2kjQ6Q6RjI1" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" data-page-node-id="ZG3EVOPAq7G5TW9HwmdUAo" />
<title>Workbuddy使用数据看板</title>
<!--CHART_JS_ASSET_TAG-->
<style>
:root{headers={"Content-Type": "application/json", header_key: header_val},
)
ctx = ssl.create_default_context()
with urllib.request.urlopen(req, timeout=30, context=ctx) as resp:
payload = json.loads(resp.read().decode("utf-8"))
if payload.get("code") != 0:
raise RuntimeError("用量 API 返回错误: %r" % (payload.get("msg"),))permissions: - file_read - file_write - network metadata: clawdbot:
permissions: - file_read - file_write - network metadata: clawdbot:
- `--no-archive`：禁用自动归档合并（默认开启，不建议）。 > ⚠️ **用户侧 token 安全提醒**：该 token 文件等同于你的 WorkBuddy 会话凭证，**请当作密码保管**——① 不要提交到任何 Git 仓库 / 云盘 / 聊天工具；② 限制文件权限（如 `chmod 600`），用完即删或在 workbuddy.cn 退出登录使其失效；③ 不要分享给他人，也不要长期留存明文。skill 只在使用该参数时联网一次，且绝不自动读取宿主 App 的凭据存储。 执行后在该目录生成 5 个文件：
* https://github.com/kurkle/color#readme
* (c) 2023 Jukka Kurkela
* Released under the MIT License
*/function _t(t){return t+.5|0}const yt=(t,e,i)=>Math.max(Math.min(t,i),e);function vt(t){return yt(_t(2.55*t),0,255)}function Mt(t){return yt(_t(255*t),0,255)}function wt(t){return yt(_t(t/2.55)/100,0,1)}function kt(t){return yt(_t(100*t),0,100)}const St={0:0,1:1,2:2,3:3,4:4,5:5,6:6,7:7,8:8,9:9,A:10,B:11,C:12,D:13,E:14,F:15,a:10,b:11,c:12,d:13,e:14,f:15},Pt=[..."0123456789ABCDEF"],Dt=t=>Pt[15&t],Ct=t=>Pt[(240&t)>>4]+Pt[15&t],Ot=t=>(240&t)>>4==(15&t);function At(t){var e=(t=>Ot(t.r)&&Ot(t.g)&&Ot(t.b)&&Ot(t.a))(t)?Dt:Ct;return t?"#"+e(t.r)+e(t.g)+e(t.b)+((t,e)=>t<255?e(t):"")(t.a,e):void 0}const Tt=/^(hsla?|hwb|hsv)\(\s*([-+.e\d]+)(?:deg)?[\s,]+([-+.e\d]+)%[\s,]+([-+.e\d]+)%(?:[\s,]+([-+.e\d]+)(%)?)?\s*\)$/;function Lt(t,e,i){const s=e*Math.min(i,1-i),n=(e,n=(e+t/30)%12)=>i-s*Math.max(Math.min(n-3,9-n,1),-1);return[n(0),n(8),n(4)]}function Et(t,e,i){const s=(s,n=(s+t/60)%6)=>i-i*e*Math.max(Math.min(n,4-n,1),0);return[s(5),s(3),s(1)]}function Rt(t,e,i){const s=Lt(t,1,.5);let n;for(e+i>1&&(n=1/(e+i),e*=n,i*=n),n=0;n<3;n++)s[n]*=1-e-i,s[n]+=e;return s}function It(t){const e=t.r/255,i=t.g/255,s=t.b/255,n=Math.max(e,i,s),o=Math.min(e,i,s),a=(n+o)/2;let r,l,h;return n!==o&&(h=n-o,l=a>.5?h/(2-n-o):h/(n+o),r=function(t,e,i,s,n){return t===n?(e-i)/s+(e<i?6:0):e===n?(i-t)/s+2:(t-e)/s+4}(e,i,s,h,n),r=60*r+.5),[0|r,l||0,a]}function zt(t,e,i,s){return(Array.isArray(e)?t(e[0],e[1],e[2]):t(e,i,s)).map(Mt)}function Ft(t,e,i){return zt(Lt,t,e,i)}function Vt(t){return(t%360+360)%360}function Bt(t){const e=Tt.exec(t);let i,s=255;if(!e)return;e[5]!==i&&(s=e[6]?vt(+e[5]):Mt(+e[5]));const n=Vt(+e[2]),o=+e[3]/100,a=+e[4]/100;return i="hwb"===e[1]?function(t,e,i){return zt(Rt,t,e,i)}(n,o,a):"hsv"===e[1]?function(t,e,i){return zt(Et,t,e,i)}(n,o,a):Ft(n,o,a),{r:i[0],g:i[1],b:i[2],a:s}}const Wt={x:"dark",Z:"light",Y:"re",X:"blu",W:"gr",V:"medium",U:"slate",A:"ee",T:"ol",S:"or",B:"ra",C:"lateg"
...[truncated 28 chars]No suspicious patterns detected.