Security audit
Security checks across malware telemetry and agentic risk
This WizNote connector mostly matches its stated purpose, but it exposes account credentials in documentation and gives broad note-modifying and network-fetching authority with weak guardrails.
Install only if you trust the publisher and need broad WizNote account automation. Replace any example credentials with your own safely stored secrets, rotate any exposed password if it was real, restrict the configured WizNote server to a trusted HTTPS endpoint, and treat delete, share, upload, URL-import, and attachment-download actions as sensitive operations that should be explicitly confirmed.
def _get(self, path, params=None):
"""GET 请求封装"""
url = f'{self.kb_server}{path}'
resp = requests.get(url, params=params or {}, headers=self._headers())
return self._parse_response(resp)
def _post(self, path, data=None, params=None):def _post(self, path, data=None, params=None):
"""POST 请求封装"""
url = f'{self.kb_server}{path}'
resp = requests.post(url, params=params or {}, json=data or {}, headers=self._headers())
return self._parse_response(resp)
def _put(self, path, data=None, params=None):def _put(self, path, data=None, params=None):
"""PUT 请求封装"""
url = f'{self.kb_server}{path}'
resp = requests.put(url, params=params or {}, json=data or {}, headers=self._headers())
return self._parse_response(resp)
def _delete(self, path, params=None):'title': title,
'type': 'collaboration',
}
resp = requests.post(url, params=params, json=data, headers={
'X-Wiz-Token': self.token, 'content-type': 'application/json'
})
result = resp.json()def download_attachment(self, doc_guid, att_guid):
url = f'{self.kb_server}/ks/attachment/download/{self.kb_guid}/{doc_guid}/{att_guid}'
timeout = (self.ATTACHMENT_CONNECT_TIMEOUT_S, self.ATTACHMENT_READ_TIMEOUT_S)
resp = requests.get(url, params={'clientType': 'web', 'clientVersion': '4.0'},
headers={'X-Wiz-Token': self.token}, stream=True, timeout=timeout)
if resp.status_code != 200:
raise Exception(f'下载附件失败: HTTP {resp.status_code}')'cookie': f'x-live-editor-token={editor_token}',
'user-agent': 'Mozilla/5.0'
}
resp = requests.get(url, headers=headers, stream=True, timeout=timeout)
if resp.status_code != 200:
raise Exception(f'下载协作资源失败: HTTP {resp.status_code}')
return resp.contentname = name or os.path.basename(file_path)
url = f'{self.kb_server}/ks/attachment/upload/{self.kb_guid}/{doc_guid}'
with open(file_path, 'rb') as f:
resp = requests.post(
url,
files={'file': (name, f)},
headers={'X-Wiz-Token': self.token},'cookie': f'x-live-editor-token={editor_token}',
'user-agent': 'Mozilla/5.0'
}
resp = requests.get(url, headers=headers, stream=True, timeout=timeout)
if resp.status_code != 200:
raise Exception(f'下载协作资源失败: HTTP {resp.status_code}')
return resp.contentrequests websocket-client python-dotenv html2text
requests websocket-client python-dotenv html2text bs4
requests websocket-client python-dotenv html2text bs4 certifi
requests websocket-client python-dotenv html2text bs4 certifi trafilatura
websocket-client python-dotenv html2text bs4 certifi trafilatura markdown
python-dotenv html2text bs4 certifi trafilatura markdown pypdf
html2text bs4 certifi trafilatura markdown pypdf pytesseract
bs4 certifi trafilatura markdown pypdf pytesseract pillow
52/52 vendors flagged this skill as clean.
No suspicious patterns detected.