📦

feeling-search

Name: feeling-search
Author: xixi048

v1.2.0 Revisión del contenido r5 Riesgo medio ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Find Visual Styles from Mood Descriptions

Everyday mood descriptions often lack precise art-direction vocabulary. This skill matches descriptions to ranked visual styles, definitions, and reference vocabulary through local matching and optional online lookups.

Compatible con: Claude Codex Code(CC)

📊 74 Adecuado

Maintain this Skill? Claim it 📊 74 Adecuado

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "feeling-search" from https://skillstore.io/skills/xixi048-feeling-search.md and its manifest at https://skillstore.io/api/skills/xixi048-feeling-search/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/xixi048-feeling-search.md Manifest firmado GET /api/skills/xixi048-feeling-search/manifest Lockfile firmado GET /api/skills/xixi048-feeling-search/lockfile

Pruébalo

Usando "feeling-search". Describe styles for the documented Chinese example about walking alone past a convenience store in rain under cold white lighting.

Resultado esperado:

Documented local example: the matched terms include light and white.
Documented candidate styles include the Delft School, Ashen Winter, and De Stijl.
These are lexical candidates, not a definitive interpretation of the scene.

Usando "feeling-search". Analyze a mood offline before a dictionary cache has been downloaded.

Resultado esperado:

No local dictionary cache is available. Download the dictionary while online, then retry offline. No network request was made.

Auditoría de seguridad

Riesgo medio

v5 • 29/10/2026 Abrir el informe versionado

Of 115 static findings, four are confirmed: unpinned package execution, insecure token-file creation, and credential forwarding in two HTTP helpers. The remaining alerts reflect documented client behavior, Markdown formatting, or readable multilingual text. A semantic finding covers quota tokens in URLs; no evidence found of malicious intent or prompt injection.

Archivos escaneados

1,136

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio

scripts/fs_api.py:111-113 scripts/fs_api.py:408-420 references/api-contract.md:133-135 references/api-contract.md:150-154

Bearer Token Exposure Through Quota Query URLs

quota_url places the quota bearer token in a URL query parameter. Balance and token-validation requests can expose this reusable credential to access logs and monitoring.

The client builds credential-bearing URLs, and the contract accepts the same token in an authentication header. Actual server logging was not verified.

Elementos de revisión de capacidades (4)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

scripts/fs_api.py:161

Python HTTP libraries

with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:

urlopen follows redirects with custom headers added by http_get, including X-FS-Quota from style and images calls. Cross-origin redirects can disclose credentials.

Medio

scripts/fs_api.py:186

Python HTTP libraries

with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:

The POST helper uses default redirect handling after adding caller-supplied headers. A redirect from cloud analysis can forward X-FS-Quota to another origin.

Medio

scripts/fs_api.py:122

Python file write/append

with open(tmp, "w", encoding="utf-8") as fh:

save_quota writes a bearer token without restrictive permissions to a predictable temporary path. With a permissive umask and traversable parent directories, other local users can read the saved credential.

Medio

SKILL.md:63-65

Ruby/shell backtick execution

```bash

The block instructs npx -y feeling-search-mcp@latest --self-test, downloading and executing an unpinned external package. Automatic confirmation creates a supply-chain execution risk.

Factores de riesgo

⚙️ Comandos externos (50)

scripts/fs_api.py:103 scripts/fs_api.py:112 scripts/fs_api.py:221 scripts/fs_api.py:417 scripts/fs_api.py:418 scripts/fs_api.py:502 scripts/fs_api.py:503 SKILL.md:17-21 SKILL.md:21-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38 SKILL.md:43-45 SKILL.md:45-57 SKILL.md:57-60 SKILL.md:60-61 SKILL.md:61 SKILL.md:63-65 SKILL.md:65-67 SKILL.md:67-68 SKILL.md:68 SKILL.md:71-72 SKILL.md:72-74 SKILL.md:74 SKILL.md:75 SKILL.md:79-81 SKILL.md:81-84 SKILL.md:84-86 SKILL.md:86 SKILL.md:95-96 SKILL.md:96-102 SKILL.md:102-104 SKILL.md:104-106 SKILL.md:106-107 SKILL.md:107-111 SKILL.md:111-113 SKILL.md:113-115 SKILL.md:115-120 SKILL.md:120-126 SKILL.md:126-129 SKILL.md:129 SKILL.md:131-135 SKILL.md:135-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146 SKILL.md:149 SKILL.md:150-151 SKILL.md:151-155

🌐 Acceso a red (11)

scripts/fs_api.py:46 scripts/fs_api.py:156 scripts/fs_api.py:161 scripts/fs_api.py:180 scripts/fs_api.py:186 scripts/fs_api.py:27 scripts/fs_api.py:31 scripts/fs_api.py:54 SKILL.md:67 SKILL.md:151 SKILL.md:197

📁 Acceso al sistema de archivos (12)

scripts/fs_api.py:33 scripts/fs_api.py:33 scripts/fs_api.py:122 scripts/fs_api.py:227 scripts/fs_api.py:117 scripts/fs_api.py:225 SKILL.md:107 SKILL.md:149 SKILL.md:198 SKILL.md:107 SKILL.md:149 SKILL.md:198

🔑 Variables de entorno (4)

scripts/fs_api.py:76 scripts/fs_api.py:80 scripts/fs_api.py:84 scripts/fs_api.py:148

Auditado por: codex Ver historial de auditorías →

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/xixi048-feeling-search/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/xixi048-feeling-search/security.svg)](https://skillstore.io/skills/xixi048-feeling-search?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/xixi048-feeling-search?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xixi048-feeling-search/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/xixi048-feeling-search.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

xixi048. (2026). feeling-search security audit report (audit version 5) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/xixi048-feeling-search/audits/5

Cita BibTeX

@techreport{xixi048-xixi048-feeling-search-2026,
  author = {xixi048},
  title = {feeling-search security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/xixi048-feeling-search/audits/5},
  note = {Author version 1.2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "feeling-search security audit report (audit version 5)"
version: "1.2.0"
type: report
authors:
  - name: "xixi048"
date-released: "2026-10-29"
url: "https://skillstore.io/skills/xixi048-feeling-search/audits/5"
identifiers:
  - type: other
    value: "skillstore:xixi048-feeling-search:audit:5"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Explore Concept Art Directions

Compare candidate styles and matched mood terms before choosing a visual direction for a scene.

Refine Image Prompt Vocabulary

Look up style terms and related words to make image-generation prompts more specific.

Prepare Brand Reference Notes

Organize style definitions and image provenance into reference notes for a visual identity discussion.

Prueba estos prompts

Find a Starting Style

Use feeling-search offline for this mood: [description under 500 characters]. Return three candidate styles, definitions, and matched words. Report a missing cache without networking.

Expand Style Vocabulary

Look up [mood word] online and list its associated styles, related words, and opposites. Use endpoints documented as free.

Compare Reference Images

Compare [up to five style identifiers]. Ask before potentially billed requests. Include definitions, image kinds, credits, licenses, and source links. Exclude placeholders.

Run a Controlled Style Search

Analyze [description] locally, then try fuzzy matching if needed. Ask before cloud fallback and confirm possible costs. Return ranked styles, matched terms, source, and limitations.

Mejores prácticas

Use short, concrete descriptions and review matched words before accepting a style ranking.
Download the dictionary with approval, verify cache freshness, and use offline mode when descriptions must stay local.
Confirm online costs, protect quota credentials, and preserve image credits and licensing information.

Evitar

Treating a local lexical match as full semantic understanding or the only correct artistic direction.
Enabling cloud analysis, spending quota, or executing the external MCP installer without informed approval.
Using placeholder images as authentic examples or assuming all references permit commercial reuse.

Preguntas frecuentes

Which AI tools can use this skill?

Claude, Codex, and Claude Code are supported. The bundled client requires Python 3.8 or later and uses standard-library modules.

Does the skill generate images?

No. It returns style candidates, vocabulary, and online reference-image metadata that can inform a separate image-generation workflow.

Can I work entirely offline?

Local analysis needs a previously downloaded, usable dictionary cache. Expired caches can fail offline; word relationships and image lookups require network access.

Is cloud analysis free?

Documentation describes free service, but billing can resume. The bundled client still requires explicit permission and a quota token for cloud fallback.

Does the bundled client understand negation and semantic meaning?

Local analysis uses term matching and optional synonym glosses. Semantic-engine and negation claims refer to an external MCP package or service.

What data can leave my machine?

Cloud analysis sends your description and quota token. Other online commands send lookup terms, style identifiers, credentials, or supplied claim information.