Mes
v1.0.0Manufacturing execution system tracker
⭐ 0· 85·0 current·0 all-time
bybytesagain4@xueyetianya
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (MES tracker) matches the included script and SKILL.md commands. All required actions (add, list, search, remove, export, stats, config) are implemented in scripts/script.sh and operate on a local data dir (~/.mes by default). No unrelated credentials, binaries, or external services are requested.
Instruction Scope
SKILL.md simply invokes scripts/script.sh commands — the instructions stay within the stated purpose. The script creates and writes files under $MES_DIR (default $HOME/.mes), reads/writes data.jsonl and config.txt, and uses standard CLI utilities (grep, sed, tail, wc, du). Note: entries are appended as JSONL using printf without escaping user-provided content, so entries containing quotes/newlines could corrupt JSONL formatting or produce malformed output; also sed -i usage will edit files in-place (behaves differently on some platforms like macOS). These are implementation caveats rather than scope creep.
Install Mechanism
No install spec; the skill is instruction-only plus a small bundled shell script. Nothing is downloaded from the network or written outside the user's home directory (by default). This is low-risk from an install perspective.
Credentials
The skill declares no required environment variables or credentials. It optionally respects MES_DIR to change the data directory. No extraneous secrets or unrelated env vars are requested.
Persistence & Privilege
The skill does not request always:true, does not modify system-wide settings, and only writes to its own data directory (~/.mes) and config file. It does perform in-place edits of its data file (sed -i) and stores data in plaintext under the user's home directory, which is expected for this kind of tool.
Assessment
This skill appears to do what it claims: a small local MES tracker implemented as a shell script that stores JSONL under ~/.mes. Before installing, consider: (1) data is stored in plaintext in your home directory — don't put secrets into entries; (2) the script does not escape user input when writing JSONL, so entries containing quotes/newlines may corrupt the data file or change output; (3) sed -i usage may behave differently on macOS (BSD sed) — test in your environment; (4) there are no network calls or credential requirements, so blast radius is limited to files under the chosen data directory. If you need strong guarantees, review the script source yourself or run it in an isolated environment; if you plan to store sensitive data, avoid using this tool or add input sanitization/encryption first.Like a lobster shell, security has layers — review code before you run it.
latestvk978qtrfyna6qgpmdkgvysrj7s839zh5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.