Use when a user asks to search for movie, TV, animation, or other media resources; provides a Quark/Baidu share link to save; wants to verify saved resources...
Security Analysis
medium confidenceThis skill appears purpose-aligned, but it requires powerful cloud-drive and NAS credentials and should only be used with accounts and storage you trust it to manage.
The stated media-to-NAS workflow matches the artifacts: search PanSou, save Quark/Baidu shares, inspect OpenList tasks, and copy saved resources to NAS/OpenList storage. These are high-impact account and storage actions, but they are disclosed and mostly preview-gated.
Implicit invocation is broad for media searches, but mutating save/copy/cancel flows instruct preview, user confirmation, and --yes before execution. Link checks and raw URL download fallbacks deserve user attention because they move private links or files through external/API workflows.
No install hooks, postinstall behavior, dependencies, or persistence setup were found. The scanned package layout has scripts/tests referring to a scripts/ directory while files are at artifact root, which is a reliability issue rather than evidence of malicious behavior.
The required QUARK_COOKIE, BAIDU_COOKIE, OPENLIST_TOKEN, OpenList URL, and default paths are proportionate to the advertised workflow and are repeatedly described as sensitive full credentials that should be masked and not committed.
No cron jobs, background workers, or hidden persistence were found. The skill can mutate cloud-drive contents, rename saved items, copy to NAS storage, and cancel OpenList tasks, but the artifacts provide confirmation gates for those operations.
Guidance
Before installing, treat the configured cookies and OpenList token as full account credentials. Use a dedicated or low-privilege OpenList token if possible, keep .env out of commits, avoid custom API bases/proxies unless you trust them, and require confirmation before any save, copy, cancel, raw_url download, or link-check operation involving private links.
Latest Release
v0.1.0
Initial release
More by @leochens
Published by @leochens on ClawHub
