我的世界JAVA版本MOD搜索整合Skill
AdvisoryAudited by Static analysis on May 4, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you use CurseForge support, the agent or script may access your CurseForge API key for search requests.
The skill can use a CurseForge API key and suggests storing it in a local file or environment variable; this is purpose-aligned but still credential handling.
CurseForge 若有 API Key 则并行搜索...；编辑 `references/curseforge_api.md`，在文件末尾添加：`CF_API_KEY=你的key`
Prefer an environment variable or secret manager, do not commit or share files containing the key, and revoke the key if it is exposed.
Minecraft mod search terms, versions, loaders, and optional CurseForge-authenticated requests may be visible to those external services.
The search script sends user search queries and filters to external mod-search services, which is expected for the skill but means query data leaves the local machine.
MODRINTH_BASE = "https://api.modrinth.com/v2"
CURSEFORGE_BASE = "https://api.curseforge.com/v1"
MCMOD_SEARCH_URL = "https://www.mcmod.cn/s?key={query}&mold=1&version={version}"Avoid putting private or sensitive information into mod search queries, and use the CurseForge key only for this intended search purpose.
Using the script means allowing a local Python program and its dependency to run for mod searches.
The skill documents optional local Python execution and an optional package install; this is central to the search function and user-directed, not hidden or automatically privileged.
The core search logic lives in `scripts/search_mods.py`. Any agent can call it as a subprocess... `pip install aiohttp`
Review the script and dependencies before enabling subprocess execution, and install packages from trusted sources in a controlled Python environment.