Skills feeling-search

📦

feeling-search

Name: feeling-search
Author: xixi048

v1.1.2 Content revision r4 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Find Visual Styles from Mood Descriptions

Mood descriptions often lack precise visual vocabulary. This skill matches short descriptions to ranked styles, defining terms, and optional reference-image metadata.

Supports: Claude Codex Code(CC)

📊 74 Adequate

Maintain this Skill? Claim it 📊 74 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "feeling-search" from https://skillstore.io/skills/xixi048-feeling-search.md and its manifest at https://skillstore.io/api/skills/xixi048-feeling-search/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/xixi048-feeling-search.md Signed manifest GET /api/skills/xixi048-feeling-search/manifest Signed lockfile GET /api/skills/xixi048-feeling-search/lockfile

Test it

Using "feeling-search". Summarize the documented rainy convenience-store example.

Expected outcome:

Documented local matches include light and white.
Style candidates include Delft School, Ash Winter, and De Stijl.
These are vocabulary matches, not a definitive interpretation of the scene.

Using "feeling-search". Explain the documented cold-light lookup.

Expected outcome:

English term: cold even light.
Meaning: uniform, high-temperature lighting with pale blue or white tones.
Related styles include Luminism.

Security Audit

Medium Risk

v4 • 10/28/2026 Open versioned report

Most alerts are false positives involving Markdown backticks, multilingual prose, ordinary Python indexing, and documented application configuration. Confirmed risks concern quota tokens in GET URLs and token files created without restrictive permissions. Configurable endpoints also lack HTTPS enforcement; no evidence found for prompt injection, obfuscated execution, or deliberate credential exfiltration.

Files scanned

1,099

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

scripts/fs_api.py:75-80 scripts/fs_api.py:111-113 scripts/fs_api.py:532-548

Quota Credentials Can Be Sent to Insecure Configured Endpoints

env_base accepts FS_API_BASE without HTTPS validation. Quota and image commands reuse saved bearer tokens against that endpoint, exposing credentials over plaintext HTTP.

The code directly concatenates the configured base with authenticated routes without checking its scheme. Exploitation requires an insecure endpoint configuration; the default uses HTTPS.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/fs_api.py:122

Python file write/append

with open(tmp, "w", encoding="utf-8") as fh:

save_quota writes bearer tokens using ordinary open without enforcing private permissions. Under permissive umasks, other local users can read accessible credential files.

Low

scripts/fs_api.py:156

Python HTTP libraries

req = urllib.request.Request(url, method="GET")

The GET helper accepts quota_url output containing the bearer token in its query string. Token validation and balance requests expose credentials to URL logging.

Low

scripts/fs_api.py:161

Python HTTP libraries

with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:

urlopen transmits GET requests used by quota validation and balance commands. Their URLs include bearer tokens, creating credential exposure through server or proxy logs.

Risk Factors

⚙️ External commands (50)

scripts/fs_api.py:103 scripts/fs_api.py:112 scripts/fs_api.py:221 scripts/fs_api.py:417 scripts/fs_api.py:418 scripts/fs_api.py:502 scripts/fs_api.py:503 SKILL.md:17-21 SKILL.md:21-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38 SKILL.md:43-45 SKILL.md:45-50 SKILL.md:50-52 SKILL.md:52-55 SKILL.md:55-57 SKILL.md:57 SKILL.md:66-67 SKILL.md:67-73 SKILL.md:73-75 SKILL.md:75-77 SKILL.md:77-78 SKILL.md:78-82 SKILL.md:82-84 SKILL.md:84-86 SKILL.md:86-91 SKILL.md:91-97 SKILL.md:97-100 SKILL.md:100 SKILL.md:102-106 SKILL.md:106-111 SKILL.md:111-113 SKILL.md:113-114 SKILL.md:114-117 SKILL.md:117 SKILL.md:120 SKILL.md:121-122 SKILL.md:122-126 SKILL.md:126-129 SKILL.md:129-133 SKILL.md:133-136 SKILL.md:136-138 SKILL.md:138 SKILL.md:139 SKILL.md:144-150 SKILL.md:150-151 SKILL.md:151-152 SKILL.md:152-153 SKILL.md:153

🌐 Network access (10)

scripts/fs_api.py:46 scripts/fs_api.py:156 scripts/fs_api.py:161 scripts/fs_api.py:180 scripts/fs_api.py:186 scripts/fs_api.py:27 scripts/fs_api.py:31 scripts/fs_api.py:54 SKILL.md:122 SKILL.md:168

📁 Filesystem access (12)

scripts/fs_api.py:33 scripts/fs_api.py:33 scripts/fs_api.py:122 scripts/fs_api.py:227 scripts/fs_api.py:117 scripts/fs_api.py:225 SKILL.md:78 SKILL.md:120 SKILL.md:169 SKILL.md:78 SKILL.md:120 SKILL.md:169

🔑 Env variables (4)

scripts/fs_api.py:76 scripts/fs_api.py:80 scripts/fs_api.py:84 scripts/fs_api.py:148

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/xixi048-feeling-search/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/xixi048-feeling-search/security.svg)](https://skillstore.io/skills/xixi048-feeling-search?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/xixi048-feeling-search?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xixi048-feeling-search/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/xixi048-feeling-search.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

xixi048. (2026). feeling-search security audit report (audit version 4) [Author version 1.1.2]. Skillstore. https://skillstore.io/skills/xixi048-feeling-search/audits/4

BibTeX citation

@techreport{xixi048-xixi048-feeling-search-2026,
  author = {xixi048},
  title = {feeling-search security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/xixi048-feeling-search/audits/4},
  note = {Author version 1.1.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "feeling-search security audit report (audit version 4)"
version: "1.1.2"
type: report
authors:
  - name: "xixi048"
date-released: "2026-10-28"
url: "https://skillstore.io/skills/xixi048-feeling-search/audits/4"
identifiers:
  - type: other
    value: "skillstore:xixi048-feeling-search:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Explore Concept-Art Directions

Translate a scene's atmosphere into candidate styles and inspect which words produced each match.

Compare Brand Visual Vocabulary

Compare style definitions and associated words before selecting a visual direction for a campaign.

Research Image-Prompt Terms

Find style names and related vocabulary to refine prompts for a separate image-generation tool.

Try These Prompts

Find Initial Style Candidates

Find visual styles for a rainy walk past a convenience store under cold white lights. Show style names and matched words.

Refine Local Matches

Analyze my description using the local dictionary, then compare fuzzy matching. Explain changed matches and do not enable cloud analysis.

Investigate a Named Style

Look up the words associated with cyberpunk. Explain distinctive vocabulary and request my approval before retrieving images or using paid endpoints.

Build a Traceable Style Comparison

Compare up to five matched styles for my brief. Separate local and cloud results, preserve image credits, and obtain approval before cloud or paid requests.

Best Practices

Start with a short scene description and review matched words before accepting a style recommendation.
Use a trusted HTTPS endpoint, protect quota credentials, and approve cloud transmission or paid requests explicitly.
Keep image credits and licensing metadata, and exclude placeholder images from style references.

Avoid

Treating lexical rankings as objective judgments or expecting this skill to generate finished images.
Assuming every command works offline or that cloud fallback works without a token because the documentation describes free service.
Sharing quota tokens in prompts or logs, or sending confidential briefs to unapproved cloud endpoints.

Frequently Asked Questions

What does this skill return?

It returns matched feeling words and ranked visual styles. Results can include names, definitions, scores, parent styles, and reference-image metadata.

What software does the client require?

The client requires Python 3.8 or later and uses only the standard library.

Can I use it without an internet connection?

Local analysis can use a fresh cached dictionary with offline mode. The initial dictionary download and remote lookup or image requests need connectivity.

Is cloud analysis free?

The documentation reports free service, but pricing can change. This client still requires a quota token before attempting cloud fallback.

Does it generate images or image prompts?

It supplies style vocabulary and retrieves image references. It does not generate finished images or run an image-generation model.

Can I reuse every reference image commercially?

Verify each image's license and source before reuse. Preserve attribution and do not treat placeholder images as real style samples.