Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed read-only Ninebot vehicle reporting helper, with expected handling of local vehicle data and map services.
Install only if you are comfortable letting a local agent read your Ninebot vehicle status, rides, and location through an already authenticated ninecli session. Map and ride-visualization features may send location or route-area data to third-party map services; use privacy=off or avoid map commands if that is not acceptable.
# Ninebot Show Skill Read-only Agent Skill for Ninebot/九号 electric vehicles. It uses a locally authenticated `ninecli` session. Never ask the user to paste a Ninebot password, SMS verification code, access token, cookie, or BLE secret into chat. ## Use this skill for
return value
explicit = os.environ.get("NINEBOT_ENV_FILE", "").strip()
candidates = [Path(explicit).expanduser()] if explicit else [CONFIG_DIR / ".env"]
for env_file in candidates:
try:
lines = env_file.read_text(encoding="utf-8", errors="ignore").splitlines()# Optional. Copy to ~/.config/ninebot-show-skill/.env and fill locally. AMAP_WEB_KEY=
# Optional. Copy to ~/.config/ninebot-show-skill/.env and fill locally. AMAP_WEB_KEY=
# Ninebot Show Skill Read-only Agent Skill for Ninebot/九号 electric vehicles. It uses a locally authenticated `ninecli` session. Never ask the user to paste a Ninebot password, SMS verification code, access token, cookie, or BLE secret into chat. ## Use this skill for
.venv/bin/ninecli vehicles --json ``` Write the returned vehicle `wnumber` into: ```text ~/.config/ninebot-show-skill/config.json
def read_status(sn: str) -> tuple[dict, float, float]:
out = subprocess.run(ninecli_argv(SKILL_DIR, "status", sn, "--json"), capture_output=True, text=True, timeout=60)
if out.returncode != 0:
raise SystemExit("ninecli status 失败，请检查登录状态和 SN")
data = json.loads(out.stdout)def coords() -> tuple[float, float]:
py = str(PYTHON if PYTHON.exists() else Path(sys.executable))
out = subprocess.run([py, str(LOCATE), "--privacy", "coordinates", "--json"], capture_output=True, text=True, timeout=120)
if out.returncode != 0:
raise SystemExit(out.stderr.strip() or "定位失败")
data = json.loads(out.stdout)def run_process(args: list[str], timeout: int = 35) -> subprocess.CompletedProcess[str]:
return subprocess.run(
args,
capture_output=True,
text=True,def load_ride(ride_id, sn):
raw = subprocess.run(ninecli_argv(SKILL_DIR, "travel", sn, "--detail", ride_id, "--json"),
capture_output=True, text=True, timeout=90).stdout
d = json.loads(raw)
pts = []def today_ride_ids(sn):
raw = subprocess.run(ninecli_argv(SKILL_DIR, "travel", sn, "--json"), capture_output=True, text=True, timeout=90).stdout
d = json.loads(raw)
today = dt.date.today()
ids = []def latest_ride():
out = subprocess.run(ninecli_argv(SKILL_DIR, "travel", SN, "--json"), capture_output=True, text=True, timeout=60)
rs = json.loads(out.stdout)["list"]
return rs[0]def ride_detail(tid):
out = subprocess.run(ninecli_argv(SKILL_DIR, "travel", SN, "--detail", tid, "--json"),
capture_output=True, text=True, timeout=60)
return json.loads(out.stdout)"$VENV/bin/python" -m pip install -r "$SKILL_DIR/requirements.txt" mkdir -p "$APP_CONFIG_DIR" chmod 700 "$APP_CONFIG_DIR" 2>/dev/null || true if [[ ! -f "$APP_CONFIG" ]]; then cp "$SKILL_DIR/templates/config.example.json" "$APP_CONFIG" chmod 600 "$APP_CONFIG" 2>/dev/null || true
chmod 700 "$APP_CONFIG_DIR" 2>/dev/null || true if [[ ! -f "$APP_CONFIG" ]]; then cp "$SKILL_DIR/templates/config.example.json" "$APP_CONFIG" chmod 600 "$APP_CONFIG" 2>/dev/null || true echo "已创建配置: $APP_CONFIG" else echo "保留现有配置: $APP_CONFIG"
def run_json(cmd: list[str], timeout: int = 180) -> dict:
out = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
if out.returncode != 0:
raise SystemExit(out.stderr.strip() or out.stdout.strip() or "命令执行失败")
return json.loads(out.stdout)No suspicious patterns detected.