Not in the top 1,000 by GitHub stars

oil-oil/oil-cover

Video cover & thumbnail skill for Claude Code & Codex. 帮你用视频画面做小红书和 B 站封面。

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

`SKILL.md`

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

375dabf52763 → 375dabf52763

Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 375dabf52763

No earlier version was observed for comparison.

Compare on GitHub

View on GitHub Add to my skills

Verified commit 375dabf52763e760467f9835c0da710cfad04884

291GitHub stars

6stars in 7 days

1skill in this repository

2commits in 30 days

Heat

6.0

Star growth, last 7 daysNot available
Star growth, last 24 hoursNot available
Rank movement, last 7 daysNot available
Commits, last 30 daysNot available
Accounts asking about it through MCP, last 7 daysNot available
Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

30-day change not yet available: not enough history.

Individual skills in this repository

oil-cover /

How it works

oil-cover

When your agent uses it

生成小红书和 B 站 AI 工具实操视频封面，支持脚本模式与 Agent 自主模式、真实视频证据、三画幅输出和可选创作者头像。仅在用户明确提到 oil-cover、$oil-cover、使用 oil-cover 或指定本 Skill 时触发；普通封面、首图、视频封面请求不要自动触发。

What it loads into context

Frontmatter

91 tokens

Always available to the agent

SKILL.md

4,367 tokens

When the skill is activated

Reference documents

17,672 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

API Key 配置入口
两种执行模式
安装位置与用户配置
修改已有风格
封面标题提炼（执行者职责）
默认入口
进阶参数
脚本职责
何时读取参考文件
不可违反
输出说明

Scripts executed separately

scripts/credential-ui/package.json
scripts/credential-ui/public/app.js
scripts/credential-ui/src/cli.ts
scripts/credential-ui/src/config.ts
scripts/credential-ui/src/page.ts
scripts/credential-ui/src/profile.ts
scripts/credential-ui/src/run.ts
scripts/credential-ui/src/server.ts
scripts/credential-ui/tests/configure.test.ts
scripts/credential-ui/tests/credentials.test.ts
scripts/credential-ui/tests/multi-key.test.ts
scripts/credential-ui/tests/native-smoke.ts
scripts/credential-ui/tests/page.test.ts
scripts/credential-ui/tests/profile.test.ts
scripts/credential-ui/tests/run.test.ts
scripts/credential-ui/tests/ui.test.ts
scripts/credential-ui/web/app.ts
scripts/generate_oil_cover.py
tests/test_cover_guards.py
tests/test_profile_business.py

Files

.github/workflows/credential-ui.ymlasset601 bytes
.gitignoreasset198 bytes
LICENSEasset1,225 bytes
NOTICEasset1,725 bytes
README.mddoc5,504 bytes
SKILL.mdcore15,916 bytes
SKILL.mdcore15,916 bytes
SKILL.mdcore15,916 bytes
SKILL.mdcore15,916 bytes
SKILL.mdcore15,916 bytes
SKILL.mdcore15,916 bytes
agents/openai.yamlasset232 bytes
assets/product-logos/anthropic.pngasset3,580 bytes
assets/product-logos/anthropic.svgasset296 bytes
assets/product-logos/claude-code.pngasset1,467 bytes
assets/product-logos/claude-code.svgasset429 bytes
assets/product-logos/claude.pngasset9,337 bytes
assets/product-logos/claude.svgasset1,701 bytes
assets/product-logos/codex-openai.pngasset7,578 bytes
assets/product-logos/codex-openai.svgasset1,368 bytes
assets/product-logos/cursor.pngasset4,422 bytes
assets/product-logos/cursor.svgasset547 bytes
assets/product-logos/deepseek.pngasset6,493 bytes
assets/product-logos/deepseek.svgasset2,164 bytes
assets/product-logos/ego-lite.pngasset103,969 bytes
assets/product-logos/feishu.pngasset89,049 bytes
assets/product-logos/gemini.pngasset19,333 bytes
assets/product-logos/gemini.svgasset651 bytes
assets/product-logos/github-copilot.pngasset7,260 bytes
assets/product-logos/github-copilot.svgasset2,019 bytes
assets/product-logos/github.pngasset6,822 bytes
assets/product-logos/grok.pngasset46,705 bytes
assets/product-logos/hypit.pngasset163,412 bytes
assets/product-logos/hypit.svgasset2,548 bytes
assets/product-logos/kimi.pngasset3,513 bytes
assets/product-logos/kimi.svgasset786 bytes
assets/product-logos/longcat.pngasset12,895 bytes
assets/product-logos/longcat.svgasset12,533 bytes
assets/product-logos/notchnotes.pngasset1,207,931 bytes
assets/product-logos/openai.pngasset11,297 bytes
assets/product-logos/openai.svgasset1,687 bytes
assets/product-logos/qoder.pngasset5,483 bytes
assets/product-logos/qwen.pngasset10,324 bytes
assets/product-logos/selector.pngasset4,693 bytes
assets/product-logos/vercel.pngasset43,758 bytes
assets/product-logos/x.pngasset102,327 bytes
assets/product-logos/z-ai-glm.pngasset43,379 bytes
docs/showcase/gallery-4x3.pngasset1,712,857 bytes
docs/showcase/gallery.pngasset2,311,257 bytes
references/agent-native-flow.mddoc12,624 bytes
references/api-key-setup.mddoc4,085 bytes
references/cover-rules.mddoc26,386 bytes
references/impact-tech-cover-style.mddoc3,428 bytes
references/product-assets.mddoc4,197 bytes
scripts/credential-ui/README.mddoc8,173 bytes
scripts/credential-ui/component.jsonasset2,237 bytes
scripts/credential-ui/manifests/default.jsonasset247 bytes
scripts/credential-ui/manifests/profiles.jsonasset147 bytes
scripts/credential-ui/package-lock.jsonasset8,679 bytes
scripts/credential-ui/package.jsonruns656 bytes
scripts/credential-ui/public/app.jsruns6,440 bytes
scripts/credential-ui/public/favicon.svgasset315 bytes
scripts/credential-ui/public/index.htmlasset1,188 bytes
scripts/credential-ui/public/style.cssasset3,155 bytes
scripts/credential-ui/src/cli.tsruns6,463 bytes
scripts/credential-ui/src/config.tsruns5,876 bytes
scripts/credential-ui/src/page.tsruns1,739 bytes
scripts/credential-ui/src/profile.tsruns4,768 bytes
scripts/credential-ui/src/run.tsruns3,335 bytes
scripts/credential-ui/src/server.tsruns11,614 bytes
scripts/credential-ui/tests/configure.test.tsruns2,532 bytes
scripts/credential-ui/tests/credentials.test.tsruns6,595 bytes
scripts/credential-ui/tests/multi-key.test.tsruns9,884 bytes
scripts/credential-ui/tests/native-smoke.tsruns4,166 bytes
scripts/credential-ui/tests/page.test.tsruns2,053 bytes
scripts/credential-ui/tests/profile.test.tsruns4,149 bytes
scripts/credential-ui/tests/run.test.tsruns2,799 bytes
scripts/credential-ui/tests/ui.test.tsruns5,074 bytes
scripts/credential-ui/tsconfig.jsonasset353 bytes
scripts/credential-ui/tsconfig.web.jsonasset237 bytes
scripts/credential-ui/web/app.tsruns6,438 bytes
scripts/generate_oil_cover.pyruns79,271 bytes
tests/test_cover_guards.pyruns8,680 bytes
tests/test_profile_business.pyruns1,245 bytes

No excerpt is shown for this license. Read the source on GitHub.

View the complete source on GitHub

Skills included

oil-cover

Repository facts

License: No license detected
Created: Jun 25, 2026
Last pushed: Nov 7, 2026
Forks: 30
Open issues: 0
Project activity: Active

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 6, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 6 notes

SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
assets/product-logos/longcat.svg:1 Analysis incomplete: physical or joined line exceeds character limit

No broad tool permissions
4 dangerous shell commandsin 4 files: scripts/credential-ui/tests/configure.test.ts:3 scripts/credential-ui/tests/native-smoke.ts:2 scripts/credential-ui/tests/run.test.ts:3 and 1 more
172 network referencesin 25 files: scripts/credential-ui/package-lock.json:21 scripts/credential-ui/tests/credentials.test.ts:67 scripts/credential-ui/tests/multi-key.test.ts:30 and 22 more
1 obfuscation signalin 1 file: scripts/generate_oil_cover.py:1579
No instruction overrides
20 executable scriptsin 20 files: scripts/credential-ui/package.json:1 scripts/credential-ui/public/app.js:1 scripts/credential-ui/src/cli.ts:1 and 17 more
47 references to secretsin 14 files: scripts/generate_oil_cover.py:37 scripts/credential-ui/tests/run.test.ts:17 scripts/credential-ui/README.md:101 and 11 more
No requests to vote in Hot

Show all 244 signals by file

`.gitignore`

Access to secretsline 2
```
[Credential-related source omitted]
```
Access to secretsline 3
```
[Credential-related source omitted]
```

`NOTICE`

Network accessline 28

- Lobe Icons (MIT-licensed icon set)       package: @lobehub/icons-static-png       https://lobehub.com/icons

Network accessline 29

package: @lobehub/icons-static-png       https://lobehub.com/icons       https://github.com/lobehub/lobe-icons

Network accessline 30
```
https://lobehub.com/icons
```
Network accessline 31
```
https://github.com/lobehub/lobe-icons
```

Network accessline 32

- Simple Icons CDN       https://cdn.simpleicons.org/   - Official brand pages (e.g. https://openai.com/brand/)

Network accessline 33
```
https://cdn.simpleicons.org/
```

Network accessline 34

- Official brand pages (e.g. https://openai.com/brand/)

Network accessline 38

- ego-lite.png .... Ego Lite browser   - selector.png .... Selector (https://oil-oil.github.io/selector/)

Network accessline 39

- selector.png .... Selector (https://oil-oil.github.io/selector/)

`README.md`

Network accessline 7

> 作者：oil 欧呦（[@oil-oil](https://github.com/oil-oil)）

Access to secretsline 73
```
[Credential-related source omitted]
```
Access to secretsline 74
```
[Credential-related source omitted]
```

`SKILL.md`

Access to secretsline 29
```
[Credential-related source omitted]
```

`assets/product-logos/anthropic.svg`

Network accessline 1

<svg fill="#000000" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Anthropic</title><path d="M17.3041 3.541h-3.6718l6.696 16.918H24Zm-10.6082 0L0 20.459h3.7442l1.3693-3.5527h7.0052l1.3693 3.5528h3.7442L10.5363 3.54

`assets/product-logos/claude-code.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Claude Code</title><path clip-rule="evenodd" d="M20.998 10.949H24v3.102h-3v3

`assets/product-logos/claude.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Claude</title><path d="M4.709 15.955l4.72-2.647.08-.23-.08-.128H9.2l-.79-.04

`assets/product-logos/codex-openai.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Codex</title><path clip-rule="evenodd" d="M8.086.457a6.105 6.105 0 013.046-.

`assets/product-logos/cursor.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Cursor</title><path d="M22.106 5.68L12.5.135a.998.998 0 00-.998 0L1.893 5.68

`assets/product-logos/deepseek.svg`

Network accessline 1

<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>DeepSeek</title><path d="M23.748 4.482c-.254-.124-.364.113-.512.234-.051.039-.094.09-.137.136-.372.397-.806.657-1.37

`assets/product-logos/gemini.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Gemini</title><path d="M20.616 10.835a14.147 14.147 0 01-4.45-3.001 14.111 1

`assets/product-logos/github-copilot.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>GithubCopilot</title><path d="M19.245 5.364c1.322 1.36 1.877 3.216 2.11 5.81

`assets/product-logos/hypit.svg`

Network accessline 1

<?xml version="1.0" encoding="UTF-8"?> <svg id="a" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="158.2 -39.5 415.6 415.6">

Network accessline 2

<svg id="a" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="158.2 -39.5 415.6 415.6">

`assets/product-logos/kimi.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Kimi</title><path d="M21.846 0a1.923 1.923 0 110 3.846H20.15a.226.226 0 01-.

`assets/product-logos/longcat.svg`

Network accessline 1

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" fill="none" version="1.1" width="379.2490234375" height="100" viewBox="0 0 379.2490234375 100"><g><g><path d="M118,71.72L148.78,71.72L148.78,63.8L127.72,63.8

`assets/product-logos/openai.svg`

Network accessline 1

<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>OpenAI</title><path d="M9.205 8.658v-2.26c0-.19.072-.333.238-.428l4.543-2.61

`references/agent-native-flow.md`

Access to secretsline 16
```
[Credential-related source omitted]
```
Access to secretsline 94
```
[Credential-related source omitted]
```

`references/api-key-setup.md`

Access to secretsline 23
```
[Credential-related source omitted]
```

`references/product-assets.md`

Network accessline 43

- OpenAI 品牌页：`https://openai.com/brand/`

Network accessline 44

- Claude Code 文档：`https://code.claude.com/docs/en/overview`

Network accessline 45

- Lobe Icons PNG package：`@lobehub/icons-static-png@1.91.0` - Lobe Icons：`https://lobehub.com/icons` - Lobe Icons GitHub：`https://github.com/lobehub/lobe-icons`

Network accessline 46

- Lobe Icons：`https://lobehub.com/icons`

Network accessline 47

- Lobe Icons GitHub：`https://github.com/lobehub/lobe-icons`

Network accessline 48

- Ego Lite app icon：`/Applications/ego lite.app/Contents/Resources/app.icns` - Selector favicon：`https://oil-oil.github.io/selector/assets/favicon.svg` - LongCat 2.0 官方 Hugging Face 仓库：`https://huggingface.co/meituan-longcat/LongCat-2.0/blo

Network accessline 49

- Selector favicon：`https://oil-oil.github.io/selector/assets/favicon.svg`

Network accessline 50

- LongCat 2.0 官方 Hugging Face 仓库：`https://huggingface.co/meituan-longcat/LongCat-2.0/blob/main/figures/longcat_logo.svg`

Network accessline 51

- Kimi 官网 favicon：`https://www.kimi.com/favicon.ico`；长期资产使用同图形的 Lobe Icons 640×640 透明 PNG / SVG

Network accessline 52

- Grok 图标：本机已安装 Grok Skill 的 `assets/grok-icon.svg`；转换为 640×640 RGBA PNG 后归档 - Simple Icons CDN：`https://cdn.simpleicons.org/` - 飞书 / Lark 图标：本机已安装的 `/Applications/Lark.app/Contents/Resources/app.icns`；转换为 640×640 RGBA PNG 后归档

Network accessline 53

- Simple Icons CDN：`https://cdn.simpleicons.org/`

`scripts/credential-ui/README.md`

Access to secretsline 101
```
[Credential-related source omitted]
```
Access to secretsline 118
```
[Credential-related source omitted]
```
Access to secretsline 124
```
[Credential-related source omitted]
```

`scripts/credential-ui/manifests/profiles.json`

Access to secretsline 7
```
[Credential-related source omitted]
```

`scripts/credential-ui/package-lock.json`

Network accessline 21

"node_modules/@napi-rs/keyring": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-2.0.0.tgz",

Network accessline 22

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-2.0.0.tgz",       "integrity": "sha512-TnrIt0nO9U2Ue9E9vJQjso1hqhIYiGrn2Ew1HBsMSqQe4+ceOqPJJwRVsV0/Wy7pqp04/doOLASyIFM3gGwZJw==",

Network accessline 23

"resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-2.0.0.tgz",

Network accessline 29

"funding": {         "type": "github",         "url": "https://github.com/sponsors/Brooooooklyn"

Network accessline 30

"type": "github",         "url": "https://github.com/sponsors/Brooooooklyn"       },

Network accessline 31

"url": "https://github.com/sponsors/Brooooooklyn"

Network accessline 48

"node_modules/@napi-rs/keyring-darwin-arm64": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-2.0.0.tgz",

Network accessline 49

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-2.0.0.tgz",       "integrity": "sha512-yvIfviiXpsDSsPdyzWWd7STZt7v774biPfMBpWkiK7rwauwWbOmVjUzgiJ11rbhJbWLqXE3CuQMyLgvcbm

Network accessline 50

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-2.0.0.tgz",

Network accessline 64

"node_modules/@napi-rs/keyring-darwin-x64": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-2.0.0.tgz",

Network accessline 65

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-2.0.0.tgz",       "integrity": "sha512-XJUONH0c5cg7M9/1Vj3WeIi8TtWYdZlo8Jqho09ga8OWm9cFNxUv7+4QZx5UK/3JSp2qiyhTlresyKdcpwpnRw

Network accessline 66

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-2.0.0.tgz",

Network accessline 80

"node_modules/@napi-rs/keyring-freebsd-x64": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-2.0.0.tgz",

Network accessline 81

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-2.0.0.tgz",       "integrity": "sha512-u/M114J9Lp3RqtIZihIqhvreNQ5f8wgLFo9tJFy+bIIO/xEHkMR0LENrfUF8hSY6FTNyS2kSbbkN6yOItBFY

Network accessline 82

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-2.0.0.tgz",

Network accessline 96

"node_modules/@napi-rs/keyring-linux-arm-gnueabihf": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-2.0.0.tgz",

Network accessline 97

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-2.0.0.tgz",       "integrity": "sha512-CHMv/KTuELo/MsrGUha52KrFGPBuBkeAonnMFUd3nNcxBTSmeJbCAZTuVSXzpessdpb4

Network accessline 98

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-2.0.0.tgz",

Network accessline 112

"node_modules/@napi-rs/keyring-linux-arm64-gnu": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-2.0.0.tgz",

Network accessline 113

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-2.0.0.tgz",       "integrity": "sha512-BeUUPGSnW026yDGT4pKuNXDnwxw0xslwiSK6cuOIsDNLi3UO93rfF/7moqKznrBldgsZr8pl9LkM

Network accessline 114

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-2.0.0.tgz",

Network accessline 128

"node_modules/@napi-rs/keyring-linux-arm64-musl": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-2.0.0.tgz",

Network accessline 129

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-2.0.0.tgz",       "integrity": "sha512-zj7wZ23Vs7SL4odnGDbWnhZhiyrnEgBe4+8dzKHDi1mTBX1d00FYlGOubkjvx3AeK7mm6G2FyF

Network accessline 130

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-2.0.0.tgz",

Network accessline 144

"node_modules/@napi-rs/keyring-linux-riscv64-gnu": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-2.0.0.tgz",

Network accessline 145

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-2.0.0.tgz",       "integrity": "sha512-xk/1SOhuk2yQvXiN+pBhR4njSfquLm1SUKUIJcPIeYV1bHFXbUsYrXdfy4NtynSW0lhs41zW

Network accessline 146

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-2.0.0.tgz",

Network accessline 160

"node_modules/@napi-rs/keyring-linux-x64-gnu": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-2.0.0.tgz",

Network accessline 161

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-2.0.0.tgz",       "integrity": "sha512-12Dq6t2TOrQTibcJcfV5bnHbTvMwEz6zSDqQLHMO2x388gGFQBAeEvw7Hmt+R1QavxspTa2ptgI7axom

Network accessline 162

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-2.0.0.tgz",

Network accessline 176

"node_modules/@napi-rs/keyring-linux-x64-musl": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-2.0.0.tgz",

Network accessline 177

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-2.0.0.tgz",       "integrity": "sha512-7NJZvFUiL1FPCrSIQ1L4IUzN6l/2zoxT3IN6j3rHTuDdIEunJaycrUovDMvPlBNP1Vh3fSYz6Pp7tF

Network accessline 178

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-2.0.0.tgz",

Network accessline 192

"node_modules/@napi-rs/keyring-win32-arm64-msvc": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-2.0.0.tgz",

Network accessline 193

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-2.0.0.tgz",       "integrity": "sha512-JTktZGXKow0HF/rhaZiQYB8DUS/iSX7S7FvJDoGxPT8mGavKE3w/vadtfKSBNDL4uGef3wu2Ll

Network accessline 194

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-2.0.0.tgz",

Network accessline 208

"node_modules/@napi-rs/keyring-win32-ia32-msvc": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-2.0.0.tgz",

Network accessline 209

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-2.0.0.tgz",       "integrity": "sha512-AzvIFTqn1hJzCPu0foeYWn+kXruAIrVq3Z2IfJ24WPbIXUdD7+rcj49fqco7b14Z6C1aUfsSTyvr

Network accessline 210

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-2.0.0.tgz",

Network accessline 224

"node_modules/@napi-rs/keyring-win32-x64-msvc": {       "version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-2.0.0.tgz",

Network accessline 225

"version": "2.0.0",       "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-2.0.0.tgz",       "integrity": "sha512-POpEUTV6U+pb69cpuOgtLV4xhcyEWDWq+/9zdiZmNxTL1AenE0MllWrbepS+Hng4M7EarQ5TB3kX69

Network accessline 226

"resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-2.0.0.tgz",

Network accessline 240

"node_modules/@types/node": {       "version": "22.20.1",       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.1.tgz",

Network accessline 241

"version": "22.20.1",       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.1.tgz",       "integrity": "sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==",

Network accessline 242

"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.1.tgz",

Network accessline 250

"node_modules/typescript": {       "version": "5.9.3",       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",

Network accessline 251

"version": "5.9.3",       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",

Network accessline 252

"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",

Network accessline 264

"node_modules/undici-types": {       "version": "6.21.0",       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",

Network accessline 265

"version": "6.21.0",       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",       "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",

Network accessline 266

"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",

`scripts/credential-ui/package.json`

Executable scriptline 1
```
Executable file
```

`scripts/credential-ui/public/app.js`

Executable scriptline 1
```
Executable file
```

Network accessline 11

let response;     try {         response = await fetch(url, { ...options, credentials: 'same-origin', cache: 'no-store',

Network accessline 12

try {         response = await fetch(url, { ...options, credentials: 'same-origin', cache: 'no-store',             headers: { 'Content-Type': 'application/json', 'X-Local-Request': '1', ...options.headers }, signal: AbortSignal.timeout(25_0

Network accessline 13

response = await fetch(url, { ...options, credentials: 'same-origin', cache: 'no-store',

`scripts/credential-ui/public/favicon.svg`

Network accessline 1

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 40 40"><rect width="40" height="40" rx="12" fill="#292929"/><path d="M12 19v-4a8 8 0 0 1 16 0v4" fill="none" stroke="#eeeeee" stroke-width="3"/><rect x="9" y="18" width="22" height="16" r

`scripts/credential-ui/src/cli.ts`

Executable scriptline 1
```
Executable file
```

`scripts/credential-ui/src/config.ts`

Executable scriptline 1
```
Executable file
```

`scripts/credential-ui/src/page.ts`

Executable scriptline 1
```
Executable file
```

`scripts/credential-ui/src/profile.ts`

Executable scriptline 1
```
Executable file
```

`scripts/credential-ui/src/run.ts`

Executable scriptline 1
```
Executable file
```

`scripts/credential-ui/src/server.ts`

Executable scriptline 1
```
Executable file
```

Network accessline 144

const addr = server.address();   if (!addr || typeof addr === 'string') throw new Error('无法启动本机服务。');   origin = `http://127.0.0.1:${addr.port}`;

Network accessline 145

if (!addr || typeof addr === 'string') throw new Error('无法启动本机服务。');   origin = `http://127.0.0.1:${addr.port}`;   const expiry = setTimeout(() => {

Network accessline 146

origin = `http://127.0.0.1:${addr.port}`;

`scripts/credential-ui/tests/configure.test.ts`

Executable scriptline 1
```
Executable file
```

Dangerous shell operationline 3

import { mkdtemp, readFile, rm } from 'node:fs/promises';

`scripts/credential-ui/tests/credentials.test.ts`

Executable scriptline 1
```
Executable file
```
Access to secretsline 60
```
[Credential-related source omitted]
```

Network accessline 67

const app = await startServer({ manifest, backend: m.backend, onComplete: v => emitted.push(v) });   t.after(app.close);   assert.equal((await fetch(app.origin + '/api/meta')).status, 401);

Network accessline 68

t.after(app.close);   assert.equal((await fetch(app.origin + '/api/meta')).status, 401);   const wrongHost = await new Promise<number | undefined>((resolve, reject) => {

Network accessline 69

assert.equal((await fetch(app.origin + '/api/meta')).status, 401);

Network accessline 73

});   assert.equal(wrongHost, 403);   const html = await fetch(app.origin);

Network accessline 74

assert.equal(wrongHost, 403);   const html = await fetch(app.origin);   assert.match(html.headers.get('Content-Security-Policy')!, /frame-ancestors 'none'/);

Network accessline 75
```
const html = await fetch(app.origin);
```
Network accessline 77
```
[Credential-related source omitted]
```
Network accessline 78
```
[Credential-related source omitted]
```

Network accessline 79

const auth = await fetch(app.origin + '/api/session', { method: 'POST', headers, body: '{}' });

Network accessline 80

assert.equal(auth.status, 200); headers.Cookie = auth.headers.get('set-cookie')!.split(';')[0];   const meta = await (await fetch(app.origin + '/api/meta', { headers })).json();   assert.equal(meta.label, manifest.label);

Network accessline 81

const meta = await (await fetch(app.origin + '/api/meta', { headers })).json();

Network accessline 83

assert.deepEqual(meta.ui, manifest.ui);   const payload = { revision: meta.revision, value: fake };   const post = (extras: Record<string, string>) => fetch(app.origin + '/api/save', { method: 'POST', headers: { ...headers, ...extras }, bod

Network accessline 84

const payload = { revision: meta.revision, value: fake };   const post = (extras: Record<string, string>) => fetch(app.origin + '/api/save', { method: 'POST', headers: { ...headers, ...extras }, body: JSON.stringify(payload) });   assert.eq

Network accessline 85

const post = (extras: Record<string, string>) => fetch(app.origin + '/api/save', { method: 'POST', headers: { ...headers, ...extras }, body: JSON.stringify(payload) });

Network accessline 86

assert.equal((await post({ Origin: 'https://attacker.example' })).status, 403);

Network accessline 88

const result = await post({}); assert.equal(result.status, 200);   const visible = [await result.text(), JSON.stringify(emitted)];   visible.push(await (await fetch(app.origin + '/api/meta', { headers })).text());

Network accessline 89

const visible = [await result.text(), JSON.stringify(emitted)];   visible.push(await (await fetch(app.origin + '/api/meta', { headers })).text());   const agent = await (await fetch(app.origin + '/agent/status', { headers })).json();

Network accessline 90

visible.push(await (await fetch(app.origin + '/api/meta', { headers })).text());

Network accessline 91

const agent = await (await fetch(app.origin + '/agent/status', { headers })).json();

Network accessline 97

const m = memory(); const app = await startServer({ manifest, backend: m.backend }); t.after(app.close);   const headers: Record<string, string> = { Origin: app.origin, 'X-Local-Request': '1', 'Content-Type': 'application/json', Authorizati

Network accessline 98
```
[Credential-related source omitted]
```

Network accessline 99

const auth = await fetch(app.origin + '/api/session', { method: 'POST', headers, body: '{}' });

Network accessline 100

headers.Cookie = auth.headers.get('set-cookie')!.split(';')[0];   assert.equal((await fetch(app.origin + '/api/cancel', { method: 'POST', headers, body: '{}' })).status, 200);   assert.equal((await fetch(app.origin + '/api/save', { method:

Network accessline 101

assert.equal((await fetch(app.origin + '/api/cancel', { method: 'POST', headers, body: '{}' })).status, 200);

Network accessline 102

assert.equal((await fetch(app.origin + '/api/save', { method: 'POST', headers, body: '{}' })).status, 409);

`scripts/credential-ui/tests/multi-key.test.ts`

Executable scriptline 1
```
Executable file
```

Network accessline 30

const jar = new Map<string, string>();   for (const app of [one, two]) {     const auth = await fetch(app.origin + '/api/session', { method: 'POST',

Network accessline 31
```
[Credential-related source omitted]
```

Network accessline 32

const auth = await fetch(app.origin + '/api/session', { method: 'POST',

Network accessline 40

for (const [app, ref, value] of [[one, a.credential, 'FAKE_FIRST_VALUE'], [two, b.credential, 'FAKE_SECOND_VALUE']] as const) {     const headers = { Cookie: cookie, Origin: app.origin, 'X-Local-Request': '1', 'Content-Type': 'application/j

Network accessline 41

const headers = { Cookie: cookie, Origin: app.origin, 'X-Local-Request': '1', 'Content-Type': 'application/json' };     const response = await fetch(app.origin + '/api/meta', { headers }); assert.equal(response.status, 200);     const meta

Network accessline 42

const response = await fetch(app.origin + '/api/meta', { headers }); assert.equal(response.status, 200);

Network accessline 43

const meta = await response.json();     const saved = await fetch(app.origin + '/api/save', { method: 'POST', headers, body: JSON.stringify({ revision: meta.revision, value }) });     assert.equal(saved.status, 200);

Network accessline 44

const saved = await fetch(app.origin + '/api/save', { method: 'POST', headers, body: JSON.stringify({ revision: meta.revision, value }) });

Network accessline 45
```
[Credential-related source omitted]
```
Network accessline 46
```
[Credential-related source omitted]
```
Network accessline 48
```
[Credential-related source omitted]
```
Network accessline 49
```
[Credential-related source omitted]
```
Network accessline 50
```
[Credential-related source omitted]
```
Network accessline 62
```
[Credential-related source omitted]
```

Network accessline 63

'X-Local-Request': '1', 'Content-Type': 'application/json' };   const auth = await fetch(app.origin + '/api/session', { method: 'POST', headers });   headers.Cookie = auth.headers.get('set-cookie')!.split(';')[0];

Network accessline 64

const auth = await fetch(app.origin + '/api/session', { method: 'POST', headers });

Network accessline 65

headers.Cookie = auth.headers.get('set-cookie')!.split(';')[0];   return {     meta: async () => (await fetch(app.origin + '/api/meta', { headers })).json(),

Network accessline 66

return {     meta: async () => (await fetch(app.origin + '/api/meta', { headers })).json(),     save: (entries: object[]) => fetch(app.origin + '/api/save', { method: 'POST', headers, body: JSON.stringify({ entries }) }),

Network accessline 67

meta: async () => (await fetch(app.origin + '/api/meta', { headers })).json(),

Network accessline 68

save: (entries: object[]) => fetch(app.origin + '/api/save', { method: 'POST', headers, body: JSON.stringify({ entries }) }),

Network accessline 69

agent: async () => (await fetch(app.origin + '/agent/status', { headers })).json(),

`scripts/credential-ui/tests/native-smoke.ts`

Executable scriptline 1
```
Executable file
```

Dangerous shell operationline 2

import { mkdtemp, writeFile, rm } from 'node:fs/promises';

Network accessline 25
```
[Credential-related source omitted]
```
Network accessline 26
```
[Credential-related source omitted]
```

Network accessline 27

const session = await fetch(app.origin + '/api/session', { method: 'POST', headers });

Network accessline 28

headers.Cookie = session.headers.get('set-cookie')!.split(';')[0];   const metadata = await (await fetch(app.origin + '/api/meta', { headers })).json();   entries.forEach(entry => { entry.owned = true; });

Network accessline 29

const metadata = await (await fetch(app.origin + '/api/meta', { headers })).json();

Network accessline 30

entries.forEach(entry => { entry.owned = true; });   const saved = await fetch(app.origin + '/api/save', { method: 'POST', headers, body: JSON.stringify({     entries: metadata.fields.map((field: { credential: string; revision: string }, in

Network accessline 31

const saved = await fetch(app.origin + '/api/save', { method: 'POST', headers, body: JSON.stringify({

Access to secretsline 46
```
[Credential-related source omitted]
```
Access to secretsline 47
```
[Credential-related source omitted]
```

`scripts/credential-ui/tests/page.test.ts`

Executable scriptline 1
```
Executable file
```

`scripts/credential-ui/tests/profile.test.ts`

Executable scriptline 1
```
Executable file
```
Network accessline 23
```
[Credential-related source omitted]
```
Network accessline 24
```
[Credential-related source omitted]
```

Network accessline 25

const session = await fetch(app.origin + '/api/session', { method: 'POST', headers });

Network accessline 26

headers.Cookie = session.headers.get('set-cookie')!.split(';')[0];       assert.equal((await fetch(app.origin)).status, 200);       const meta = await (await fetch(app.origin + '/api/meta', { headers })).json();

Network accessline 27

assert.equal((await fetch(app.origin)).status, 200);

Network accessline 28

const meta = await (await fetch(app.origin + '/api/meta', { headers })).json();

Network accessline 29

const saved = await fetch(app.origin + '/api/save', { method: 'POST', headers, body: JSON.stringify({ entries: meta.fields.map((f: { credential: string; revision: string }, i: number) => ({ credential: f.credential, revision: f.revision, va

Access to secretsline 55
```
[Credential-related source omitted]
```

`scripts/credential-ui/tests/run.test.ts`

Executable scriptline 1
```
Executable file
```

Dangerous shell operationline 3

import { mkdtemp, writeFile, rm } from 'node:fs/promises';

Access to secretsline 17
```
[Credential-related source omitted]
```
Access to secretsline 18
```
[Credential-related source omitted]
```
Access to secretsline 20
```
[Credential-related source omitted]
```
Access to secretsline 26
```
[Credential-related source omitted]
```
Access to secretsline 34
```
[Credential-related source omitted]
```
Access to secretsline 35
```
[Credential-related source omitted]
```
Access to secretsline 37
```
[Credential-related source omitted]
```

`scripts/credential-ui/tests/ui.test.ts`

Executable scriptline 1
```
Executable file
```

Dangerous shell operationline 38

runInNewContext(await readFile(new URL('../public/app.js', import.meta.url), 'utf8'), context);

`scripts/credential-ui/web/app.ts`

Executable scriptline 1
```
Executable file
```

Network accessline 13

let response: Response;   try {     response = await fetch(url, { ...options, credentials: 'same-origin', cache: 'no-store',

Network accessline 14

try {     response = await fetch(url, { ...options, credentials: 'same-origin', cache: 'no-store',       headers: { 'Content-Type': 'application/json', 'X-Local-Request': '1', ...options.headers }, signal: AbortSignal.timeout(25_000) });

Network accessline 15

response = await fetch(url, { ...options, credentials: 'same-origin', cache: 'no-store',

`scripts/generate_oil_cover.py`

Executable scriptline 1
```
#!/usr/bin/env python3
```
Access to secretsline 37
```
[Credential-related source omitted]
```

Network accessline 52

SKILL_DIR = _resolve_skill_dir() DEFAULT_RULES_FILE = SKILL_DIR / "references" / "cover-rules.md" DEFAULT_API_BASE = "https://zenmux.ai/api/v1"

Network accessline 53

DEFAULT_RULES_FILE = SKILL_DIR / "references" / "cover-rules.md" DEFAULT_API_BASE = "https://zenmux.ai/api/v1" DEFAULT_ANALYSIS_MODEL = "google/gemini-3.8-flash"

Network accessline 54

DEFAULT_API_BASE = "https://zenmux.ai/api/v1"

Access to secretsline 59
```
[Credential-related source omitted]
```
Access to secretsline 81
```
[Credential-related source omitted]
```

Network accessline 138

def read_urlopen_json(request: urllib.request.Request, timeout: int, *, attempts: int = 3) -> dict[str, Any]:

Network accessline 140

for attempt in range(attempts):         try:             with urllib.request.urlopen(request, timeout=timeout) as response:

Network accessline 141

try:             with urllib.request.urlopen(request, timeout=timeout) as response:                 return json.loads(response.read().decode("utf-8"))

Network accessline 142

with urllib.request.urlopen(request, timeout=timeout) as response:

Access to secretsline 201
```
[Credential-related source omitted]
```
Access to secretsline 296
```
[Credential-related source omitted]
```
Access to secretsline 297
```
[Credential-related source omitted]
```
Access to secretsline 298
```
[Credential-related source omitted]
```
Network accessline 1017
```
[Credential-related source omitted]
```
Access to secretsline 1017
```
[Credential-related source omitted]
```

Network accessline 1018

data = json.dumps(payload).encode("utf-8")     request = urllib.request.Request(         url,

Network accessline 1019
```
request = urllib.request.Request(
```
Access to secretsline 1024
```
[Credential-related source omitted]
```
Access to secretsline 1035
```
[Credential-related source omitted]
```
Network accessline 1064
```
request = urllib.request.Request(
```
Access to secretsline 1069
```
[Credential-related source omitted]
```
Access to secretsline 1094
```
[Credential-related source omitted]
```
Access to secretsline 1131
```
[Credential-related source omitted]
```

Possible obfuscationline 1579

output.write_bytes(base64.b64decode(b64))

Network accessline 1581

url = find_output_value(response, "url")     if url:         request = urllib.request.Request(url)

Network accessline 1582

if url:         request = urllib.request.Request(url)         last_error: BaseException | None = None

Network accessline 1583
```
request = urllib.request.Request(url)
```

Network accessline 1585

for attempt in range(3):             try:                 with urllib.request.urlopen(request, timeout=timeout) as resp:

Network accessline 1586

try:                 with urllib.request.urlopen(request, timeout=timeout) as resp:                     output.write_bytes(resp.read())

Network accessline 1587

with urllib.request.urlopen(request, timeout=timeout) as resp:

Access to secretsline 1648
```
[Credential-related source omitted]
```
Access to secretsline 1686
```
[Credential-related source omitted]
```
Access to secretsline 1701
```
[Credential-related source omitted]
```
Access to secretsline 1823
```
[Credential-related source omitted]
```
Access to secretsline 1876
```
[Credential-related source omitted]
```
Access to secretsline 1885
```
[Credential-related source omitted]
```

`tests/test_cover_guards.py`

Executable scriptline 1
```
Executable file
```
Access to secretsline 20
```
[Credential-related source omitted]
```
Access to secretsline 61
```
[Credential-related source omitted]
```

`tests/test_profile_business.py`

Executable scriptline 1
```
Executable file
```
Access to secretsline 19
```
[Credential-related source omitted]
```
Access to secretsline 23
```
[Credential-related source omitted]
```
Access to secretsline 24
```
[Credential-related source omitted]
```

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Declared and executed: 1 fact

Contacts zenmux.ai, which SKILL.md, the README and the plugin manifest do not mentionscripts/generate_oil_cover.py:54High confidence

Signal confidence: 167 facts

Network access in prose of documentationREADME.md:7Low confidence
Access to secrets in prose of documentationREADME.md:73Low confidence
Access to secrets in prose of documentationREADME.md:74Low confidence
Access to secrets in prose of the SKILL.mdSKILL.md:29Low confidence
Access to secrets in prose of documentationreferences/agent-native-flow.md:16Low confidence
Access to secrets in prose of documentationreferences/agent-native-flow.md:94Low confidence
Access to secrets in prose of documentationreferences/api-key-setup.md:23Low confidence
Network access in prose of documentationreferences/product-assets.md:43Low confidence
Network access in prose of documentationreferences/product-assets.md:44Low confidence
Network access in prose of documentationreferences/product-assets.md:45Low confidence
Network access in prose of documentationreferences/product-assets.md:46Low confidence
Network access in prose of documentationreferences/product-assets.md:47Low confidence
Network access in prose of documentationreferences/product-assets.md:48Low confidence
Network access in prose of documentationreferences/product-assets.md:49Low confidence
Network access in prose of documentationreferences/product-assets.md:50Low confidence
Network access in prose of documentationreferences/product-assets.md:51Low confidence
Network access in prose of documentationreferences/product-assets.md:52Low confidence
Network access in prose of documentationreferences/product-assets.md:53Low confidence
Access to secrets in prose of documentationscripts/credential-ui/README.md:101Low confidence
Access to secrets in code of documentationscripts/credential-ui/README.md:118Low confidence
Access to secrets in code of documentationscripts/credential-ui/README.md:124Low confidence
Executable script in code of a file that runsscripts/credential-ui/package.json:1High confidence
Executable script in code of a file that runsscripts/credential-ui/public/app.js:1High confidence
Network access in code of a file that runsscripts/credential-ui/public/app.js:11High confidence
Network access in code of a file that runsscripts/credential-ui/public/app.js:12High confidence
Network access in code of a file that runsscripts/credential-ui/public/app.js:13High confidence
Executable script in code of a file that runsscripts/credential-ui/src/cli.ts:1High confidence
Executable script in code of a file that runsscripts/credential-ui/src/config.ts:1High confidence
Executable script in code of a file that runsscripts/credential-ui/src/page.ts:1High confidence
Executable script in code of a file that runsscripts/credential-ui/src/profile.ts:1High confidence
Executable script in code of a file that runsscripts/credential-ui/src/run.ts:1High confidence
Executable script in code of a file that runsscripts/credential-ui/src/server.ts:1High confidence
Network access in code of a file that runsscripts/credential-ui/src/server.ts:144High confidence
Network access in code of a file that runsscripts/credential-ui/src/server.ts:145High confidence
Network access in code of a file that runsscripts/credential-ui/src/server.ts:146High confidence
Executable script in code of a testscripts/credential-ui/tests/configure.test.ts:1Low confidence
Dangerous shell operation in code of a testscripts/credential-ui/tests/configure.test.ts:3Low confidence
Executable script in code of a testscripts/credential-ui/tests/credentials.test.ts:1Low confidence
Access to secrets in code of a testscripts/credential-ui/tests/credentials.test.ts:60Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:67Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:68Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:69Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:73Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:74Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:75Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:77Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:78Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:79Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:80Low confidence
Network access in code of a testscripts/credential-ui/tests/credentials.test.ts:81Low confidence

and 117 more

Works with

Agent compatibility, from the files in this repository
Agent	Status	Evidence	Install to
Claude Code	Compatible	Standard SKILL.md SKILL.md	`.claude/skills/<skill-name>/`
Codex	Compatible	Standard SKILL.md SKILL.md	`.agents/skills/<skill-name>/`
Cursor	Compatible	Standard SKILL.md SKILL.md	`.cursor/skills/<skill-name>/`
Gemini CLI	Compatible	Standard SKILL.md SKILL.md	`.gemini/skills/<skill-name>/`
GitHub Copilot	Compatible	Standard SKILL.md SKILL.md	`.github/skills/<skill-name>/`
OpenCode	Compatible	Standard SKILL.md SKILL.md	`.opencode/skills/<skill-name>/`

Native The repository ships a manifest, folder or frontmatter field for this agent.
Compatible A standard SKILL.md that this agent can read.
Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

oil-oil/oil-cover

History

SKILL.md

Share this page

Heat

Stars over time

Individual skills in this repository

How it works

oil-cover

Frontmatter

SKILL.md

Reference documents

The playbook

Scripts executed separately

Files

Skills included

Repository facts

Before you install

.gitignore

NOTICE

README.md

SKILL.md

assets/product-logos/anthropic.svg

assets/product-logos/claude-code.svg

assets/product-logos/claude.svg

assets/product-logos/codex-openai.svg

assets/product-logos/cursor.svg

assets/product-logos/deepseek.svg

assets/product-logos/gemini.svg

assets/product-logos/github-copilot.svg

assets/product-logos/hypit.svg

assets/product-logos/kimi.svg

assets/product-logos/longcat.svg

assets/product-logos/openai.svg

references/agent-native-flow.md

references/api-key-setup.md

references/product-assets.md

scripts/credential-ui/README.md

scripts/credential-ui/manifests/profiles.json

scripts/credential-ui/package-lock.json

scripts/credential-ui/package.json

scripts/credential-ui/public/app.js

scripts/credential-ui/public/favicon.svg

scripts/credential-ui/src/cli.ts

scripts/credential-ui/src/config.ts

scripts/credential-ui/src/page.ts

scripts/credential-ui/src/profile.ts

scripts/credential-ui/src/run.ts

scripts/credential-ui/src/server.ts

scripts/credential-ui/tests/configure.test.ts

scripts/credential-ui/tests/credentials.test.ts

scripts/credential-ui/tests/multi-key.test.ts

scripts/credential-ui/tests/native-smoke.ts

scripts/credential-ui/tests/page.test.ts

scripts/credential-ui/tests/profile.test.ts

scripts/credential-ui/tests/run.test.ts

scripts/credential-ui/tests/ui.test.ts

scripts/credential-ui/web/app.ts

scripts/generate_oil_cover.py

tests/test_cover_guards.py

tests/test_profile_business.py

How the signals fit together

Works with

You might also use

oil-oil/beautify-github-readme

oil-oil/oil-motion

oil-oil/draw-ui

oil-oil/oil-icon

Appllama/appllama-skills

OneMoh/html-explainer

`SKILL.md`

`.gitignore`

`NOTICE`

`README.md`

`SKILL.md`

`assets/product-logos/anthropic.svg`

`assets/product-logos/claude-code.svg`

`assets/product-logos/claude.svg`

`assets/product-logos/codex-openai.svg`

`assets/product-logos/cursor.svg`

`assets/product-logos/deepseek.svg`

`assets/product-logos/gemini.svg`

`assets/product-logos/github-copilot.svg`

`assets/product-logos/hypit.svg`

`assets/product-logos/kimi.svg`

`assets/product-logos/longcat.svg`

`assets/product-logos/openai.svg`

`references/agent-native-flow.md`

`references/api-key-setup.md`

`references/product-assets.md`

`scripts/credential-ui/README.md`

`scripts/credential-ui/manifests/profiles.json`

`scripts/credential-ui/package-lock.json`

`scripts/credential-ui/package.json`

`scripts/credential-ui/public/app.js`

`scripts/credential-ui/public/favicon.svg`

`scripts/credential-ui/src/cli.ts`

`scripts/credential-ui/src/config.ts`

`scripts/credential-ui/src/page.ts`

`scripts/credential-ui/src/profile.ts`

`scripts/credential-ui/src/run.ts`

`scripts/credential-ui/src/server.ts`

`scripts/credential-ui/tests/configure.test.ts`

`scripts/credential-ui/tests/credentials.test.ts`

`scripts/credential-ui/tests/multi-key.test.ts`

`scripts/credential-ui/tests/native-smoke.ts`

`scripts/credential-ui/tests/page.test.ts`

`scripts/credential-ui/tests/profile.test.ts`

`scripts/credential-ui/tests/run.test.ts`

`scripts/credential-ui/tests/ui.test.ts`

`scripts/credential-ui/web/app.ts`

`scripts/generate_oil_cover.py`

`tests/test_cover_guards.py`

`tests/test_profile_business.py`