Skills writing-to-logseq

📦

writing-to-logseq

Name: writing-to-logseq
Author: C0ntr0lledCha0s

v1.0.0 Content revision r2 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Write Structured Content to Logseq

Manual Logseq updates make note capture and structured maintenance slow. This skill creates and updates graph content through authenticated API operations.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "writing-to-logseq" from https://skillstore.io/skills/c0ntr0lledcha0s-writing-to-logseq.md and its manifest at https://skillstore.io/api/skills/c0ntr0lledcha0s-writing-to-logseq/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/c0ntr0lledcha0s-writing-to-logseq.md Signed manifest GET /api/skills/c0ntr0lledcha0s-writing-to-logseq/manifest Signed lockfile GET /api/skills/c0ntr0lledcha0s-writing-to-logseq/lockfile

Test it

Using "writing-to-logseq". Create a project page for Atlas with status Active and three launch tasks.

Expected outcome:

Created the Atlas page with an Active status property. Added three task blocks under a Launch section.

Using "writing-to-logseq". Append today's decisions to Team Notes and tag the new block Decision.

Expected outcome:

Appended a dated decisions block to Team Notes. Added the Decision tag without replacing existing content.

Using "writing-to-logseq". Delete the obsolete planning block.

Expected outcome:

Located the requested block and prepared a deletion preview. The operation is waiting for explicit confirmation.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Most command and reconnaissance alerts are Markdown or defensive prose, so they are false positives. The script has genuine network, environment-secret, and destructive-write risks.

Files scanned

1,712

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

scripts/write-operations.py:92-105 scripts/write-operations.py:114-124

Configurable credential exfiltration path

Workspace configuration can select any environment variable as a token and send it to an unrestricted configured URL.

The code resolves a configuration-selected environment variable, then includes its value in a bearer header sent to a configurable URL.

Medium

scripts/write-operations.py:196-211 scripts/write-operations.py:258-273

Destructive operations lack confirmation

Page and block deletion methods remove user data after existence checks without confirmation, dry-run support, or child protection.

Both methods directly call Logseq deletion APIs. Their only safeguards check whether the target exists.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/write-operations.py:105

Python environment access

self.token = os.environ.get(var_name, "")

A workspace configuration value selects any environment variable to read. That value can later become the bearer token for a configurable endpoint.

Medium

scripts/write-operations.py:114

Python HTTP libraries

req = urllib.request.Request(

The request targets a configurable URL and attaches a bearer token. A hostile configuration could redirect the credential.

Medium

scripts/write-operations.py:124

Python HTTP libraries

with urllib.request.urlopen(req, timeout=30) as response:

urlopen sends the prepared authenticated request to the configured endpoint. This creates real outbound network and credential exposure risk.

Medium

scripts/write-operations.py:81

Python environment access

self.url = url or os.environ.get("LOGSEQ_API_URL", "http://127.0.0.1:12315")

LOGSEQ_API_URL controls the destination for authenticated requests. An untrusted environment value can redirect traffic away from Logseq.

Medium

scripts/write-operations.py:100

Configuration library

self.url = http_config.get("url", self.url)

Workspace configuration can replace the request destination. The code does not restrict the value to a trusted loopback Logseq endpoint.

Low

scripts/write-operations.py:17

Python HTTP libraries

import urllib.request

The imported HTTP library supports real network requests to the Logseq API. This access is expected but remains a network capability.

Low

scripts/write-operations.py:82

Python environment access

self.token = token or os.environ.get("LOGSEQ_API_TOKEN", "")

The code reads the Logseq bearer token from the environment. This is expected credential access but handles sensitive data.

Low

scripts/write-operations.py:102

Configuration library

token = http_config.get("token", "")

Workspace configuration supplies the bearer token or an environment reference. This makes untrusted project configuration security-sensitive.

Risk Factors

⚙️ External commands (39)

🌐 Network access (14)

references/write-operations.md:343 references/write-operations.md:347 references/write-operations.md:355 references/write-operations.md:348 references/write-operations.md:348 scripts/write-operations.py:17 scripts/write-operations.py:114 scripts/write-operations.py:124 scripts/write-operations.py:78 scripts/write-operations.py:81 scripts/write-operations.py:99 scripts/write-operations.py:78 scripts/write-operations.py:81 scripts/write-operations.py:99

🔑 Env variables (6)

scripts/write-operations.py:81 scripts/write-operations.py:82 scripts/write-operations.py:105 scripts/write-operations.py:98 scripts/write-operations.py:100 scripts/write-operations.py:102

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/c0ntr0lledcha0s-writing-to-logseq/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/c0ntr0lledcha0s-writing-to-logseq/security.svg)](https://skillstore.io/skills/c0ntr0lledcha0s-writing-to-logseq?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/c0ntr0lledcha0s-writing-to-logseq?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/c0ntr0lledcha0s-writing-to-logseq/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/c0ntr0lledcha0s-writing-to-logseq.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

C0ntr0lledCha0s. (2026). writing-to-logseq security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/c0ntr0lledcha0s-writing-to-logseq/audits/9

BibTeX citation

@techreport{c0ntr0lledcha0s-c0ntr0lledcha0s-writing-to-logseq-2026,
  author = {C0ntr0lledCha0s},
  title = {writing-to-logseq security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/c0ntr0lledcha0s-writing-to-logseq/audits/9},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "writing-to-logseq security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
  - name: "C0ntr0lledCha0s"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/c0ntr0lledcha0s-writing-to-logseq/audits/9"
identifiers:
  - type: other
    value: "skillstore:c0ntr0lledcha0s-writing-to-logseq:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Capture meeting notes

Create a dated Logseq page with attendees, decisions, tasks, and structured properties.

Maintain research knowledge

Append findings, tags, and typed properties to existing research pages without manual graph editing.

Automate daily records

Sync conversation summaries and timestamped notes into namespaced Logseq pages.

Try These Prompts

Create a simple page

Create a Logseq page titled [title]. Add this content: [content]. Show the planned write before execution.

Add structured meeting notes

Create meeting notes for [date] with attendees [names], decisions [decisions], and action items [tasks]. Use clear properties and tags.

Update an existing project page

Find the Logseq page [title]. Append [update], set status to [status], and add tags [tags]. Do not replace existing content.

Safely synchronize a conversation

Summarize this conversation into [page]. Preview created blocks, properties, and links. Avoid duplicates and require approval before destructive changes.