📦

botsee

Name: botsee
Author: rivalsee

v0.3.0 内容修订 r1 中风险 🌐 网络访问📁 文件系统访问🔑 环境变量⚙️ 外部命令

Measure Brand Visibility Across AI Answers

Brands struggle to measure how AI systems mention them and their competitors. BotSee manages research inputs, runs analyses, and turns results into actionable reports.

支持: Claude Codex Code(CC)

⚠️ 50 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "botsee" from https://skillstore.io/skills/rivalsee-botsee.md and its manifest at https://skillstore.io/api/skills/rivalsee-botsee/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/rivalsee-botsee.md 已签名 manifest GET /api/skills/rivalsee-botsee/manifest 已签名 lockfile GET /api/skills/rivalsee-botsee/lockfile

测试它

正在使用“botsee”。 Check the active BotSee site and show the current account balance.

预期结果:

Active site: Example Company. Remaining balance: 4,280 credits. No paid operation was started.

正在使用“botsee”。 Summarize the latest competitor results for the completed analysis.

预期结果:

Acme appears most often across the evaluated responses.
Northstar has the strongest average rank in the enterprise segment.
Three competitors account for most recorded mentions.

正在使用“botsee”。 Generate content from the latest analysis for the selected site.

预期结果:

A blog post was generated from the latest analysis and saved as a timestamped Markdown file. The response also reports credits used.

安全审计

中风险

v1 • 2026/9/14 打开版本化报告

The skill intentionally contacts the BotSee API, persists local state, and writes generated content. Most high-severity static matches are false positives caused by API-key identifiers, documented config paths, UUID handling, and Markdown backticks. Two medium issues remain: sensitive files are permissioned after creation, and secrets can be passed through command-line arguments.

已扫描文件

2,681

分析行数

复核项

已忽略误报

已确认安全问题 (2)

中

botsee.py:248-253 botsee.py:603-627

Credential files created before restrictive permissions

Two credential-writing paths apply mode 0600 only after writing. On a permissive or preexisting BotSee directory, another local user could briefly read signup tokens or API keys.

Both functions visibly open and write sensitive files before calling chmod. The safer save_user_config path demonstrates that an umask can prevent this creation-time window.

中

botsee.py:1826-1827 botsee.py:1847-1848 botsee.py:1856-1860 botsee.py:1868-1881 SKILL.md:155-169

Secrets accepted through command-line arguments

API keys, signup tokens, reset tokens, and payment proofs can be supplied as command arguments. These values may remain in shell history or appear in process listings.

The argparse definitions and usage instructions explicitly place credential-like values after flags. Command arguments commonly persist outside the process receiving them.

能力复核项 (8)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

botsee.py:181

Python file write/append

with open(USER_CONFIG, "w") as f:

This line writes the BotSee API key and account metadata to the user configuration file. The write is intentional and normally protected by a restrictive umask, but it persists sensitive data.

中

botsee.py:199

Python file write/append

with open(WORKSPACE_CONFIG, "w") as f:

This line writes generation settings to .context/botsee-config.json in the current workspace. The data is not secret, but the command has a real workspace modification side effect.

中

botsee.py:251

Python file write/append

with open(PENDING_SIGNUP, "w") as f:

This line writes pending signup metadata, including the setup token, to the user home directory. Permissions are tightened only after the write, which creates a brief exposure risk.

中

botsee.py:625

Python file write/append

with open(config_path, "w") as f:

This line writes an API key to the user configuration file. The file is changed to mode 0600 afterward, but the credential can briefly inherit broader creation permissions.

中

botsee.py:1220

Python file write/append

with open(filename, "w") as f:

This line creates a timestamped Markdown file in the current directory using content returned by the service. It is an intentional output write that can replace a same-named file.

低

botsee.py:113

Python HTTP libraries

req = urllib.request.Request(url, data=body, headers=headers, method=method)

This line constructs outbound BotSee API requests that can include request data and an authorization header. The network use is expected, but it is a real external data transfer.

低

botsee.py:121

Python HTTP libraries

with urllib.request.urlopen(req, timeout=timeout, context=ssl_context) as resp:

This line sends the prepared HTTPS request to the configured BotSee endpoint. Certificate and hostname verification remain enabled, so the network risk is limited and intentional.

低

botsee.py:19

Python environment access

BASE_URL = os.environ.get("BOTSEE_BASE_URL", "https://botsee.io")

The code reads BOTSEE_BASE_URL and uses it as the destination for later authenticated requests. This is intentional configuration, but an untrusted value could redirect API traffic.

风险因素

🌐 网络访问 (9)

botsee.py:12 botsee.py:113 botsee.py:121 botsee.py:19 botsee.py:211 botsee.py:342 SKILL.md:84 SKILL.md:123 SKILL.md:559

📁 文件系统访问 (29)

🔑 环境变量 (50)

⚙️ 外部命令 (50)

SKILL.md:69-71 SKILL.md:71-78 SKILL.md:78-80 SKILL.md:80-83 SKILL.md:83-85 SKILL.md:85-107 SKILL.md:107-116 SKILL.md:116-118 SKILL.md:118-119 SKILL.md:119-122 SKILL.md:122-124 SKILL.md:124-131 SKILL.md:131-136 SKILL.md:136-138 SKILL.md:138-146 SKILL.md:146-149 SKILL.md:149-152 SKILL.md:152 SKILL.md:153 SKILL.md:155-156 SKILL.md:156-160 SKILL.md:160-166 SKILL.md:166-168 SKILL.md:168 SKILL.md:169-173 SKILL.md:173-175 SKILL.md:175-177 SKILL.md:177-181 SKILL.md:181-183 SKILL.md:183-187 SKILL.md:187-191 SKILL.md:191-197 SKILL.md:197-199 SKILL.md:199 SKILL.md:200-204 SKILL.md:204-206 SKILL.md:206-208 SKILL.md:208-211 SKILL.md:211-212 SKILL.md:212-213 SKILL.md:213-221 SKILL.md:221-223 SKILL.md:223-227 SKILL.md:227-229 SKILL.md:229-233 SKILL.md:233-235 SKILL.md:235-241 SKILL.md:241-243 SKILL.md:243-245 SKILL.md:245-253

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/rivalsee-botsee/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/rivalsee-botsee/security.svg)](https://skillstore.io/skills/rivalsee-botsee?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/rivalsee-botsee?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rivalsee-botsee/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/rivalsee-botsee.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

rivalsee. (2026). botsee security audit report (audit version 1) [Author version 0.3.0]. Skillstore. https://skillstore.io/skills/rivalsee-botsee/audits/1

BibTeX 引用

@techreport{rivalsee-rivalsee-botsee-2026,
  author = {rivalsee},
  title = {botsee security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/rivalsee-botsee/audits/1},
  note = {Author version 0.3.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "botsee security audit report (audit version 1)"
version: "0.3.0"
type: report
authors:
  - name: "rivalsee"
date-released: "2026-09-14"
url: "https://skillstore.io/skills/rivalsee-botsee/audits/1"
identifiers:
  - type: other
    value: "skillstore:rivalsee-botsee:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

100

可维护性

内容

社区

规范符合性

你能构建什么

Track brand visibility

Measure brand appearances, ranking, competitors, keywords, and cited sources across supported AI answer providers.

Build audience research

Create customer types, personas, and buyer questions before running a structured visibility analysis.

Automate competitive reporting

Run analyses, retrieve detailed results, inspect credit usage, and generate content from agent workflows.

试试这些提示

Check account status

Check my BotSee account status, active site, remaining credits, and available next actions. Do not start any paid operation.

Set up a research site

Create a BotSee site for [DOMAIN] with [TYPE_COUNT] customer types, [PERSONA_COUNT] personas per type, and [QUESTION_COUNT] questions per persona.

Run and summarize analysis

Run a BotSee analysis for [SITE_UUID]. Summarize leading competitors, recurring keywords, cited sources, and remaining credits after completion.

Compare detailed findings

Analyze [SITE_UUID] using [MODELS] and [SCOPE]. Retrieve responses, competitors, keywords, sources, and recommendations, then identify three evidence-backed priorities.

最佳实践

Check the active site and credit balance before starting analysis or generation.
Use explicit site and analysis identifiers when several projects are active.
Review generated content and recommendations before publishing or applying them.

避免

Do not place live API keys, reset tokens, or payment proofs in shared prompts or logs.
Do not retry create commands blindly because repeated calls can create duplicate resources.
Do not start paid analysis or generation without confirming the site, scope, and expected credit use.

常见问题

What does this skill measure?

It uses BotSee to measure brand mentions, competitors, rankings, keywords, sources, and AI responses.

Which AI tools can use this skill?

The report declares support for Claude, Codex, and Claude Code.

Does the skill require a BotSee account?

Yes. Most operations require a BotSee API key, network access, and available credits.

Where are credentials stored?

The skill stores the API key and active site in ~/.botsee/config.json.

Does analysis finish immediately?

No. The command polls BotSee until completion and can wait for up to ten minutes.

Does the skill write project files?

Yes. It writes workspace configuration and saves generated blog content as a timestamped Markdown file.

开发者详情

作者

rivalsee

许可证

MIT

作者版本

v0.3.0

Skillstore 修订

仓库

https://github.com/rivalsee/botsee-skill/tree/4a0f13a79c2ac6fd93c72b7d06275d8350951bac/skills/botsee

引用

42d356d060430b424cc46118d00a354afa5575c1

维护新鲜度

2026/9/14

使用量

0 次下载 · 0 次浏览

文件结构

📄 botsee.py

📄 SKILL.md