Picsee Short Link

PicSee URL shortener with QR code generation, analytics charts, and link management via CLI. Use when the user asks to shorten a URL, generate QR codes, visu...

Security Scan

The package is a coherent Node.js CLI for PicSee (shortening, QR, analytics) that stores an encrypted token locally and calls the stated PicSee/QR/chart endpoints — nothing in the files or instructions appears disproportionate to that purpose.

Purpose & Capability

Name/description match implementation: CLI contacts picsee endpoints (api.pics.ee and chrome-ext.picsee.tw), generates QR and chart URLs, lists/edits links, and stores a token. The included source and compiled CLI implement the documented features.

Instruction Scope

SKILL.md instructs running the included Node CLI, saving an encrypted token in ~/.openclaw, creating tmp images, and contacting the documented external hosts (api.pics.ee, chrome-ext.picsee.tw, api.qrserver.com, quickchart.io). These actions are within the stated scope (shortening, analytics, QR/chart image handling).

Install Mechanism

There is no installer spec (install-only skill), but compiled CLI files are bundled and SKILL.md requires Node.js >=18. The package does not declare a formal install step — ensure your agent environment has Node >=18 available before use. No remote downloads or execution of arbitrary external archives are present.

Credentials

The skill does not request unrelated environment variables or external credentials. It stores a PicSee API token locally (encrypted) and uses only local filesystem and Node built-ins (fs, crypto, https). The token storage and usage are consistent with the documented authenticated features.

Persistence & Privilege

always is false and the skill writes only its own token/salt and temporary images under ~/.openclaw and the skill workspace. It does not modify other skills or system-wide configs. Autonomous invocation is allowed by default (normal for skills).

Assessment

This skill appears to do what it says: it's a Node.js CLI that talks to PicSee and related services and stores your PicSee API token encrypted at ~/.openclaw/.picsee_token with a salt at ~/.openclaw/.picsee_salt. Before installing: 1) Ensure Node.js >=18 is available (the bundled CLI requires it — the registry metadata omitted listing Node as a required binary). 2) Review and, if desired, run the CLI source in a sandboxed environment first. 3) Note the token is encrypted but stored locally; if an attacker gains full disk access they could attempt to recover it (the key derivation uses hostname+username + salt, which mitigates but does not eliminate risk). 4) Confirm you trust the publisher (no homepage is provided) and that network access to api.pics.ee, chrome-ext.picsee.tw, api.qrserver.com and quickchart.io is acceptable. 5) If you want least privilege, create and use a PicSee token with limited scope or monitor network activity when first using the skill.

URL shortener with QR code generation, analytics charts, and link management via CLI.

Works with any agent that can run shell commands (OpenClaw, Claude Code, Codex, etc.).

---

CLI Path

node ~/.openclaw/workspace/skills/picsee-short-link/cli/dist/cli.js

For brevity, examples below use picsee as alias.

---

Quick Reference

Shorten a URL

picsee shorten "https://example.com/long-url"
picsee shorten "https://example.com" --slug mylink
picsee shorten "https://example.com" --slug mylink --domain pse.is --title "My Title" --tags seo,marketing

Analytics

picsee analytics mylink

Generate Analytics Chart

picsee chart mylink

Fetches analytics and returns a QuickChart URL visualizing daily clicks.

Generate QR Code

picsee qr "https://pse.is/mylink"
picsee qr "https://pse.is/mylink" --size 500

List Links

picsee list
picsee list --limit 10
picsee list --start "2026-03-31T23:59:59" --keyword "campaign"
picsee list --tag seo --starred

--start queries backward from that time (default: now). Use the END of the period, e.g. 2026-03-31T23:59:59 for March 2026.

Edit a Link

picsee edit mylink --url "https://new-destination.com"
picsee edit mylink --slug newslug --title "New Title" --tags a,b,c

Requires Advanced plan.

Delete / Recover

picsee delete mylink
picsee recover mylink

Authentication

picsee auth <token>
picsee auth-status

Token source: https://picsee.io → avatar → Settings → API → Copy token.

Help

picsee help

---

Full Options

shorten

Flag	Description
--slug <slug>	Custom slug (3-90 chars)
--domain <domain>	Short link domain (default: pse.is)
--title <title>	Preview title (Advanced plan)
--desc <desc>	Preview description (Advanced plan)
--image <url>	Preview thumbnail (Advanced plan)
--tags t1,t2	Comma-separated tags (Advanced plan)
--utm s:m:c:t:n	UTM params — source:medium:campaign:term:content

list

Flag	Description
--start <time>	Query backward from this time (default: now)
--limit <n>	Results per page (1-50, default 50)
--keyword <kw>	Search title/description (Advanced, 3-30 chars)
--tag <tag>	Filter by tag (Advanced)
--url <url>	Filter by exact destination URL
--slug <slug>	Filter by exact slug
--starred	Starred links only
--api-only	API-generated links only
--cursor <mapId>	Pagination cursor

edit

Flag	Description
--url <url>	New destination URL
--slug <slug>	New slug
--domain <domain>	New domain
--title <title>	New preview title
--desc <desc>	New preview description
--image <url>	New preview thumbnail
--tags t1,t2	New tags
--expire <iso>	Expiration time (ISO 8601)

---

Auth Modes

Mode	API Host	Features
Unauthenticated	chrome-ext.picsee.tw	Create short links only
Authenticated	api.pics.ee	Create + analytics + list + search + edit + delete

Auto-detected: if encrypted token exists at ~/.openclaw/.picsee_token, authenticated mode is used.

---

Security

• Token encryption: AES-256-CBC, IV stored alongside ciphertext
• Key derivation: SHA-256(random-salt + hostname + "-" + username) — the 32-byte random salt is generated once and stored at ~/.openclaw/.picsee_salt (mode 0600), making the key unpredictable even if hostname/username are known
• File permissions: 0600 on both token and salt files

---

Agent Recipes (Post-Processing)

Download QR Code as Image

After picsee qr, download and send the image:

mkdir -p ~/.openclaw/workspace/skills/picsee-short-link/tmp
curl -s -o ~/.openclaw/workspace/skills/picsee-short-link/tmp/<ENCODE_ID>_qr.png "<originalQrUrl>"

Send via message tool with filePath: "~/.openclaw/workspace/skills/picsee-short-link/tmp/<ENCODE_ID>_qr.png".

Download Chart as Image

After picsee chart, download and send the image:

mkdir -p ~/.openclaw/workspace/skills/picsee-short-link/tmp
curl -s -o ~/.openclaw/workspace/skills/picsee-short-link/tmp/<ENCODE_ID>_chart.png "<originalChartUrl>"

Send via message tool with filePath: "~/.openclaw/workspace/skills/picsee-short-link/tmp/<ENCODE_ID>_chart.png".