by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it claims (save/search/manage notes). Before installing, understand: 1) it will perform an OAuth Device Flow and start a background poll to obtain an API key if none is configured — you will be shown a verification link and code to complete in your browser; 2) once authorized the skill will write the API key / client ID into ~/.openclaw/openclaw.json for future use; 3) do not paste API keys into chat — prefer the OAuth flow or set GETNOTE_API_KEY and GETNOTE_CLIENT_...详细分析 ▾
✓ 用途与能力
Name/description (note save/search/kb) match what code and SKILL.md do: call openapi.biji.com endpoints, OAuth device flow, image upload helper. Optional env vars (GETNOTE_API_KEY, GETNOTE_CLIENT_ID, GETNOTE_OWNER_ID) are appropriate for this integration and no unrelated credentials or binaries are requested.
ℹ 指令范围
SKILL.md gives concrete API calls and device-flow OAuth logic. It instructs the agent to auto-start the OAuth device polling (background) and to write obtained credentials into ~/.openclaw/openclaw.json — this is within the integration's needs but worth noting because the skill will initiate network polling and modify the agent config during setup without additional user commands beyond starting the flow.
✓ 安装机制
No install spec or external downloads; the package is instruction-first and includes two small Python helper scripts. No remote URLs or archive extraction in install steps.
✓ 凭证需求
Only optional environment variables relate directly to the service (API key, client id, owner id). The scripts read or accept these vars only as expected for uploading images and OAuth; there are no extra secrets or unrelated environment/config path requests.
ℹ 持久化与权限
always:false (normal). The skill instructs writing API credentials into ~/.openclaw/openclaw.json for future use — expected for an OAuth-backed integration but users should be aware credentials will be persisted in their OpenClaw config. The skill does not request system-wide privileges or alter other skills' configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.7.02026/3/6
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install getnote
镜像加速npx clawhub@latest install getnote --registry https://cn.longxiaskill.com