bilei@1.0.6
CAUTION· static onlyPublisher claims: "一句话，10秒帮你避雷一个品类。反投毒购物顾问：连做了17年广告的行内人，装修买家电时都搜不到一句客观评价（央视3·15实锤GEO投毒产业链）。本技能只认公关不了的数据——行政处罚、抽检不合格、召回公告，把散落在投诉平台角落的差评捞回来，每条证据标等级（官方处罚>第三方检测>媒体实测>用户投诉>软文），反软广反GEO投毒，溢价对价必须跑脚本定量（TCO/EAC、临界故障率、溢价ROI、公允价格上限），并审计制造商是自产还是代工贴牌、质量与售后谁兜底，最后用夯/顶级/人上人/NPC/拉五级梯队直观排序，结论先行给唯一推荐，没有可靠选项直说「目前没有」。触发词：想买XX、买什么、求推荐、对比、值不值得买、避坑、扫雷、性价比、质价比、溢价、历史低价、好价、预算XX买什么、哪个牌子靠谱、是不是贴牌、代工、梯队。English: anti-astro-turfing shopping advisor — evidence-graded product vetting with manufacturer/ODM audit and a 5-tier ranking, use when the user asks what to buy or whether something is worth it." Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-09 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Latin word with Cyrillic or Greek look-alike letters (homoglyph). Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
ΔEACFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.No other findings across 995 lines in 7 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim zhashushu: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.