Get笔记同步

从 Get 笔记 (biji.com) 同步语音笔记到本地 Markdown

Security Scan

The skill's code and instructions match its stated purpose (syncing Get 笔记/ biji.com notes to local Markdown); nothing obviously malicious or disproportionate was found, though a few operational notes and mild oddities are worth reviewing before use.

Purpose & Capability

The skill claims to sync Get 笔记 (biji.com) and all code implements that (API calls, formatting, token refresh, Playwright login). One minor oddity: the API baseUrl is set to https://get-notes.luojilab.com while auth and login URLs reference notes-api.biji.com and www.biji.com. This could be a legitimate proxy/gateway but is worth verifying that these hosts are intended and trustworthy.

Instruction Scope

Runtime instructions are specific: run node scripts/sync.js (with optional env vars), and scripts document the state files they create (.token-cache.json, .auth-state.json, .sync-state.json). The scripts read/write those files, may launch a browser via Playwright for interactive login (or headless refresh), and dedupe.js deletes duplicate markdown files. All of this is within the described sync/formating scope and is transparently documented in SKILL.md and README.

Install Mechanism

There is no packaged install spec in the registry entry (instruction-only), but package.json depends on 'playwright'. Installing will pull Playwright from npm and (when first run) may download browser binaries — a non-trivial network/download step. The dependency is consistent with the documented browser-login behavior, but users should expect the typical npm/Playwright install footprint.

Credentials

The skill does not request unrelated credentials or environment secrets. It uses non-sensitive environment vars (OUTPUT_DIR, SINCE_DATE, TEST_LIMIT) and manages JWT/refresh_token obtained from biji.com via the browser/auth API. It reads and writes local state files containing tokens and browser storage (sensitive), which is expected for its operation; no unexplained external credentials are requested.

Persistence & Privilege

The skill is not always-enabled and does not ask to modify other skills or system-wide settings. It persists its own state files (.auth-state.json, .token-cache.json, .sync-state.json) in the skill directory — expected for this use case. Dedupe script will delete files inside the configured notes directory when run (explicit behavior).

Assessment

This skill appears to do what it says — sync biji.com (Get 笔记) notes to local Markdown — but review these operational considerations before installing or running: - Verify the network hosts: the code uses multiple domains (get-notes.luojilab.com, notes-api.biji.com, www.biji.com). Confirm these are expected (official or trusted proxies) for your account before providing interactive login. - npm / Playwright: run npm install in a controlled environment. Playwright will download browser binaries and increase the install footprint; review package.json and package-lock if you have strict supply-chain policies. - Tokens and state files: the skill stores tokens and browser storage locally in .token-cache.json and .auth-state.json. Treat these files as sensitive — store them in a secure location and avoid committing them to VCS. If you stop using the skill, delete those files to revoke persistent access. - Browser login & headless refresh: the scripts may open a real browser for manual login (interactive) or run headless to refresh tokens. Only run these actions on a machine you trust and avoid running on shared hosts. - File deletion: dedupe.js will permanently delete duplicate .md files under OUTPUT_DIR when run. Run it only after backing up your notes or testing in a copy of your notes directory. - Test first: run in a test/output directory (set OUTPUT_DIR) and use TEST_LIMIT to sync a small number of notes to confirm behavior and file formats before doing a full sync. If you want greater assurance, request confirmation from the skill author about the use of the luojilab host (if unfamiliar), or inspect network traffic during a test run to verify requests go only to expected endpoints.

24/7 录音卡 → Get Notes (biji.com) AI 转录 → 本地 Markdown。

同步命令

cd <skill-dir> && OUTPUT_DIR="<your-output-dir>" node scripts/sync.js

认证链：缓存 JWT（30min）→ refresh_token 静默刷新（~90天）→ Playwright 浏览器登录（最后手段）。 首次运行需弹出浏览器登录 biji.com，之后约 90 天内无需再开浏览器。

环境变量：

• OUTPUT_DIR — 输出目录（默认 ./notes）
• SINCE_DATE — 起始日期过滤（默认 2026-01-01）
• TEST_LIMIT — 测试模式，限制同步条数（默认 0 = 全部）

输出结构

Get笔记/
  YYYY-MM/
    YYYY-MM-DD_分类_标题.md          ← 摘要文件（短录音原文内嵌）
    YYYY-MM-DD_分类_标题_原文.md      ← 原文转录（长录音，>50行时分离）

分类由 classifyNote() 智能判断：客户、会议、灵感、待办、复盘、选题。

文件格式

摘要文件（主文件）

---
title: "标题"
date: 2026-02-27
time: "10:34"
note_id: 1234567890
category: 客户
duration_min: 45           # 有录音时才有
transcript: "2026-02-27_客户_标题_原文.md"  # 长录音才有
---

（AI 生成的智能总结 + 章节概要 + 金句精选）

## 附件
- [audio (45 min)](https://...)

## 原文              ← 短录音时内嵌
[00:00] [Speaker 1] ...

原文文件（长录音）

---
date: 2026-02-27
note_id: 1234567890
title: "标题"
summary: "2026-02-27_客户_标题.md"   # 互相引用
---

## [03:25] 章节标题          ← 章节标题自动注入
[03:25] [Speaker 1] 正文...

辅助脚本

• rebuild-state.js — 从 API 重建同步状态（丢失 .sync-state.json 时用）
• dedupe.js — 去重工具

状态文件

• .sync-state.json — 已同步的 note_id 列表（增量同步依赖）
• .token-cache.json — JWT + refresh_token 缓存
• .auth-state.json — Playwright 浏览器登录状态