Qq Zone Photo
v1.0.3管理 QQ空间相册。支持扫码登录、列出相册、浏览照片、上传照片、下载照片/相册、创建相册。当用户需要备份、整理或管理 QQ空间中的照片时使用此技能。
⭐ 2· 8.5k·0 current·0 all-time
byenoyao@wscats
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (manage QQ Zone photo albums) align with the included CLI script which implements QR login, list/upload/download/create album actions. The tool legitimately needs QQ session cookies and file access for uploads/downloads.
Instruction Scope
SKILL.md instructs the agent to run the shipped Python script using a cookies.json and to extract cookies from the browser if needed. The instructions reference only cookies and photo paths required for the stated functionality. They explicitly say credentials are stored locally and not uploaded. This is within scope, but the instructions grant the agent permission to read/write a cookies.json and to open files/viewers (QR image).
Install Mechanism
There is no install spec (instruction-only), reducing install-time risk. The repo contains requirements.txt (requests, Pillow, qrcode, pycryptodome) so a Python venv with those packages is necessary; the SKILL.md assumes the environment is prepared but does not automate package installation—users should install from trusted registries.
Credentials
The script requires QQ session cookies (p_skey, skey, uin) which are proportionate to the stated purpose. However, SKILL.md metadata lists requires.auth ["qq-cookies"] while the registry metadata shows no required env/config — a mild inconsistency. No unrelated credentials or system secrets are requested in the files examined.
Persistence & Privilege
Skill is not forced-always; it does not request elevated or persistent platform privileges. It writes/reads its own cookies.json and temporary QR image files only, which is expected behavior for this tool.
Assessment
This skill appears to do what it says: manage QQ空间 photos using local QQ session cookies. Before installing: (1) Review the full script yourself or run it in an isolated environment, since it performs network calls to QQ endpoints and reads/writes cookies.json and photo files. (2) Only provide cookies you trust and avoid sharing them—cookies grant full access. (3) Install Python dependencies from official PyPI packages in a dedicated virtualenv. (4) If you need stronger assurance, run the tool once with network monitoring to confirm it only talks to qq.com/up.qzone.qq.com endpoints and does not post data to unknown hosts. (5) Note the SKILL.md metadata declares an auth requirement that isn't reflected in registry fields—confirm how your platform will supply the cookie credential before use.Like a lobster shell, security has layers — review code before you run it.
latestvk973gw3wee066hk5p8byxdjn6982z027
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📸 Clawdis