b2b-factory-search@1.0.0
VERIFIED· install onlyPublisher claims: "给企业采购人（买家）用的选厂助手：把一句"谁家能做"变成一份带工商信息与能力标签的候选厂家清单， 供采购筛选生产/代工/定制合作伙伴后进店沟通。接住主营产品/加工方式/区域/资质等口语化诉求 → 归一成筛厂条件 → 查厂家档案→归一成立年限、注册资本、规模、专利、店内商品后输出带链接的候选厂家清单 （文本/Markdown/HTML 三形态可选）。只报档案里取到的信息，取不到就说取不到， 绝不编产能、编资质、编交期；只做信息呈现，不下"哪家确定靠谱/值得合作"的评级结论。 只做查询整理，不代下单、不代发询盘；联系方式不直出，由用户点击跳转查看。 触发词: 找厂家, 有没有能生产…的工厂, 想找" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 435 lines in 5 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.