aikey@0.3.11

VERIFIED

Publisher claims: "AI KEY ——两套技能的总入口:做内容(选题/写稿/审核/复盘)+ 看生意(组合体检/营收归因/客户集中度/依赖风险/拿不准的决策)。三种模式:新手上路演示、任务前路由、任务后导航。不知道用哪个就回这里。 触发方式:/aikey、/新手上路、/aikey 教程、「做条视频」「出个口播」「今天拍什么」「内容下一步怎么走」;新手教程:/aikey 新手指南、/aikey 新手、「这个怎么用」「第一次用,带我走一遍」「不知道能干嘛」 Single entry point for both skill sets — content (topic, script, review, retro) and business (portfolio, revenue, concentration, dependency, decisions). Three modes: guided onboarding demo, pre-task routing, post-task navigation. Trigger: /aikey, "make a short video", "what should I shoot today", "how do I use this" —— AI KEY · 不给公式,给判据。每条规则都标了实测代价。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher iamzifei · joined 1 days agoInstalls 505Last detonated 25 h ago
$clawhub install aikey
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 91/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
npx invocation of non-well-known packagescripts/new-version.sh:80 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

No other findings across 2,044 lines in 11 files.