Is giraffe-tree/flomo-add safe?
Use with caution. giraffe-tree/flomo-add is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the flomo-add skill by giraffe-tree a trust score of 75/100 with 4 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/giraffe-tree/flomo-add
Is giraffe-tree/flomo-add safe to install?
This skill provides legitimate functionality to add notes to the flomo service but creates data exfiltration risks by sending user content to external webhook URLs without validation. While the functionality is as intended, the configurable webhook mechanism could be abused for unauthorized data collection.
What security issues were found in giraffe-tree/flomo-add?
Category Scores
Findings (4)
HIGH Unvalidated External Data Transmission -35 ▶
The skill sends arbitrary user content to external webhook URLs without domain validation. The webhook URL is read from a user-configurable .flomo.config file, creating a pathway for data exfiltration if a malicious URL is configured.
MEDIUM Webhook Abuse Potential -25 ▶
While the skill provides legitimate functionality for flomo note-taking, the webhook mechanism could be abused by attackers who control the configuration file to exfiltrate sensitive information from user inputs.
LOW Configuration File Access -10 ▶
The skill reads configuration files that may contain sensitive webhook URLs, though this is part of normal operation.
LOW Executable Python Script -10 ▶
The skill contains executable Python code, though the code appears benign and uses only standard library functions.
Should I install giraffe-tree/flomo-add?
Oathe's verdict for giraffe-tree/flomo-add is CAUTION with a trust score of 75/100. Recommendation: Install with caution.