a-share-ledger-workflow@1.0.0
VERIFIEDPublisher claims: "A股 8 步研究流程（方向→产业→链条→筛选→跟踪→门禁→持仓→复盘）＋台账规范＋15 个零依赖 Python 脚本。Use for end-to-end A-share research, screening, tracking ledgers, pre-buy gating, position tracking, and post-trade review." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-03 and scored it 80/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
MEDIUM
Python subprocess execution detectedscripts/q3_watch.py:100 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Access to sensitive file pathsscripts/sync_ledgers_to_feishu.py:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsscripts/sync_ledgers_to_feishu.py:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
Python subprocess execution detectedscripts/refresh_a1.py:259 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedscripts/feishu_append_notice.py:124 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedscripts/refresh_a1.py:272 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Access to sensitive file pathsscripts/sync_ledgers_to_feishu.py:98 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
Python subprocess execution detectedscripts/profit_guard.py:1079 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Access to sensitive file pathsscripts/watchdog.py:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
Unicode escape sequence detectedscripts/validate_ledgers.py:1096 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07MEDIUM
Python subprocess execution detectedscripts/sync_ledgers_to_feishu.py:247 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedscripts/sync_ledgers_to_feishu.py:164 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05