Security audit
Security checks for vulnerabilities and agentic risk
The avatar workflow matches its description, but its uploader can send your image and temporary upload token over an unencrypted connection.
Require HTTPS for upload destinations and redirects before using the local uploader. Prefer a reviewed, pinned package over the remote one-line installers. Run the browser script only on your own logged-in music.163.com account with an image you intend to publish, and keep temporary tokens out of shell history, repositories, and screenshots.
scripts/upload_nos.pyDiscovered HTTP upload endpoints expose upload credentials and image bytes
The intermediary can capture the temporary upload token and image, or alter the uploaded bytes. The evidence supports exposure of the object-scoped upload credential, not theft of the user's account session.
Piping the network response directly into bash turns unverified remote content into executable commands, allowing an altered installer to act with the user's privileges. This is the execution mechanism of the same supply-chain vulnerability identified by SC2, not evidence of a separate malicious chaining attempt.
Linux / macOS / WSL：
curl -fsSL https://raw.githubusercontent.com/yuan-dev39/netease-dynamic-avatar/main/install.sh | bash
Windows PowerShell：
所给命令执行的是 Git 版本标记及远程发布操作，与网易云动态头像设置、图片转换或上传没有直接关系，也未体现任何已声明的头像处理功能。这属于未声明且用途明显不同的仓库操作，而非所述流程的必要实现细节。
The supplied code performs skill-distribution operations rather than the declared avatar-setting workflow. It contains no image conversion, NetEase/NOS upload, avatar update, token handling, or animation verification. Publishing the current directory to ClawHub is a separate external action not disclosed in the description, rather than an implementation detail of setting an avatar. This assessment is limited to the supplied code chunk.
包名与声明主题相关，但不能据此确认包内实现。仅就所提供的代码而言，其行为是安装另一个技能，而声明描述的是完整的动态头像操作流程。因此存在可见行为与声明不一致；无法从该片段判断被安装技能的实际功能或安全性。
Without declared permissions the skill's intent is opaque and cannot be validated.
The installation command downloads a script from a mutable GitHub main branch and immediately executes it without review or integrity verification. A compromised repository or malicious upstream change could execute arbitrary commands with the installing user's privileges, exposing local files and credentials; the legitimate installation context does not remove this supply-chain risk, though no malicious payload is shown.
Linux / macOS / WSL：
curl -fsSL https://raw.githubusercontent.com/yuan-dev39/netease-dynamic-avatar/main/install.sh | bash
Windows PowerShell：