trailsnap-cli

TrailSnap CLI 命令行工具，用于查询照片、相册、标签、位置和人物等信息。当用户需要查看照片、相册数据时调用此技能。

Security Scan

The skill's code matches its stated photo-querying purpose, but there are inconsistencies around how credentials are handled and what the instructions permit, so proceed with caution.

Purpose & Capability

The name/description align with the implementation: the CLI provides commands to query photos, albums, tags, locations, people, folders and media via a TrailSnap API. However the skill metadata declares no required env vars while the code requires an API URL and token (saved to/loaded from a local .env file). Also SKILL.md states the agent "cannot directly read the .env file," which contradicts runtime code that reads .env for the API URL and token.

Instruction Scope

SKILL.md restricts usage to the CLI and instructs users to run 'config set' to save API URL and token into .env; it does not ask the agent to read unrelated files. But the explicit admonition that the agent/skill "cannot directly read .env" is misleading: the provided code (utils.load_env / make_request) does read the .env file at runtime to obtain credentials. There are no instructions to exfiltrate data to unexpected endpoints—the API calls go to the configured TRAILSNAP_API_URL.

Install Mechanism

No install spec or remote downloads are present; this is an instruction-and-code bundle with local Python code only. No external installation URLs, package installs, or archive extraction are used.

Credentials

The metadata lists no required environment variables, yet the code requires and writes an API token and base URL into a plaintext .env file (TRAILSNAP_API_TOKEN / TRAILSNAP_API_URL). Storing a bearer token in a local .env file may expose credentials if the skill or host environment is shared. The number of secrets requested (one API token) is reasonable for the task, but the mismatch between declared requirements and actual behavior is concerning.

Persistence & Privilege

always is false and the skill does not request system-wide privileges. It writes a local .env file in its directory to persist configuration, which is expected for a CLI tool and does not modify other skills or global agent settings.

What to consider before installing

This skill appears to implement a CLI that talks to a TrailSnap API and stores a bearer token in a local .env file. Before installing or using it: (1) confirm the skill's origin/publisher (source is unknown); (2) be aware your API token will be saved in plaintext in the skill directory — avoid using highly privileged tokens or use an isolated account; (3) verify the configured TRAILSNAP_API_URL points to a trusted server (the code will call whatever base URL you set); (4) note the SKILL.md claim that the agent "cannot directly read .env" contradicts the code: the tool reads .env at runtime, so do not rely on that text as a security guarantee; (5) if you still want to use it, run it in a sandbox or VM, inspect the code yourself, and rotate the token after use. Provide the publisher/source or provenance if you want a higher-confidence assessment.

TrailSnap CLI 技能

此技能允许使用 trailsnap-cli Python 脚本与 TrailSnap 后端 API 进行交互。

功能

1. 根据指定条件（可选过滤参数）查询照片列表。
2. 查询分类标签、相册、位置和人物（面部）信息。
3. 查询挂载的存储文件夹（目录）列表。

初始配置

首次使用该工具前，需要配置 API 地址和 Token：

python {baseDir}/cli.py config set --url <API_BASE_URL> --token <YOUR_API_TOKEN>

配置信息将被保存到同目录下的 .env 文件中。

使用方法

使用前可以通过 python {baseDir}/cli.py <command> -h 或 python {baseDir}/cli.py <command> <subcommand> -h 查看每个命令的详细帮助信息。通常情况下，你需要先根据用户的问题逐步筛选出检索条件，然后查询符合条件的照片列表。如果需要访问照片的媒体文件（如 base64 编码或直接下载文件），你可以使用 medias 命令。

你只能通过cli.py脚本运行，不能直接调用API。更不能直接读取.env文件中的配置信息。

使用 Python 运行脚本：

python {baseDir}/cli.py <command> <subcommand> [options]

详细的命令参考请参考 reference.md 文件。

示例

请参考 examples/simple.md 文件。