Cubox Integration (International & China)

Save web pages and memos to Cubox using the Open API

Security Scan

The skill appears to implement exactly what it claims (saving URLs and memos to Cubox), but its metadata omits the required CUBOX_API_URL environment variable and the source/homepage is unknown — these inconsistencies warrant caution.

Purpose & Capability

Name, description, SKILL.md, README, and the included Python scripts all align: they post URL or memo JSON to a Cubox API endpoint. However, the registry metadata declares no required environment variables or primary credential while the runtime instructions and scripts require a CUBOX_API_URL value — this metadata omission is an incoherence.

Instruction Scope

SKILL.md and the two scripts are narrowly scoped: they only read CUBOX_API_URL from the environment, build a JSON payload (type, content, optional fields) and POST it to the configured API URL. They do not reference other files, scan system state, or call out to unexpected external endpoints beyond the provided API URL.

Install Mechanism

There is no install spec (instruction-only), and the README simply instructs installing the standard 'requests' Python package. Nothing in the package tries to download or execute third-party code during install.

Credentials

The scripts require a sensitive credential-like value (CUBOX_API_URL containing a token) but the skill metadata does not declare any required env vars or a primary credential. Because the API URL is effectively a bearer token and the code will POST arbitrary content there, the missing metadata and lack of provenance for the API endpoint are proportionality concerns.

Persistence & Privilege

The skill does not request persistent or elevated privileges (always is false, it does not modify other skills or system configs). Autonomous invocation is allowed by default but not combined here with other high-risk factors.

What to consider before installing

This skill's code appears to do only what it says: send JSON to the API URL you provide. However, before installing or using it: 1) Verify the API URL you set (CUBOX_API_URL) is the official Cubox-provided endpoint (preferably on cubox.pro) — the URL contains a token and acts as a bearer credential, so treat it as secret. 2) Do not set that variable to an untrusted server; the script will POST whatever content you pass and could send sensitive data to any endpoint you configure. 3) The skill metadata should declare CUBOX_API_URL as a required env var — its absence is an oversight; ask the publisher to fix metadata or inspect the code yourself (which is short and readable) before use. 4) Run the scripts in a controlled environment (virtualenv) and install only the 'requests' package. 5) Because the source/homepage is unknown, prefer to obtain these scripts directly from an official Cubox source or the skill author and confirm they match this code. If you cannot verify provenance, treat the skill as untrusted.

Cubox Integration Skill

This skill enables saving content to Cubox using the Open API. Cubox is a read-it-later and bookmarking service that supports saving web URLs and quick memos.

Prerequisites

1. Cubox Premium Membership - The Open API is a premium feature
2. API Key - Get your API URL from Cubox settings:
   • Go to Cubox Preferences > Extension Center and Automation > API Extension
   • Enable "API Link" to get your personal API URL

⚠️ Security: Your API URL is a unique credential. Keep it private and never share it.

Environment Setup

Set the CUBOX_API_URL environment variable with your personal API URL:

export CUBOX_API_URL="https://cubox.pro/c/api/save/YOUR_TOKEN"

Available Tools

1. Save URL (scripts/save_url.py)

Save a web page URL to Cubox.

python scripts/save_url.py <url> [--title "Title"] [--description "Description"] [--tags "tag1,tag2"] [--folder "Folder Name"]

Parameters:

• url (required): The web page URL to save
• --title: Optional title for the bookmark
• --description: Optional description
• --tags: Comma-separated list of tags
• --folder: Target folder name (defaults to Inbox)

Example:

python scripts/save_url.py "https://example.com/article" --title "Great Article" --tags "tech,reading" --folder "Articles"

2. Save Memo (scripts/save_memo.py)

Save a quick memo/note to Cubox.

python scripts/save_memo.py <content> [--title "Title"] [--description "Description"] [--tags "tag1,tag2"] [--folder "Folder Name"]

Parameters:

• content (required): The memo text content
• --title: Optional title (Cubox will auto-generate if not provided)
• --description: Optional description
• --tags: Comma-separated list of tags
• --folder: Target folder name (defaults to Inbox)

Example:

python scripts/save_memo.py "Remember to review the quarterly report" --title "Todo" --tags "work,reminder"

API Rate Limits

• Premium users: 500 API calls per day

Notes

• After saving, Cubox cloud will automatically process the content (article parsing, snapshot archiving, etc.), which may take some time
• If title or description is not specified, Cubox will attempt to generate them automatically
• If no folder is specified, content will be saved to your Inbox by default