bilei@1.0.7
VERIFIED· install onlyPublisher claims: "一句话，10秒帮你避雷一个品类。反投毒购物顾问：连做了17年广告的行内人，装修买家电时都搜不到一句客观评价（央视3·15实锤GEO投毒产业链）。本技能只认公关不了的数据——行政处罚、抽检不合格、召回公告，把散落在投诉平台角落的差评捞回来，每条证据标等级（官方处罚>第三方检测>媒体实测>用户投诉>软文），反软广反GEO投毒，溢价对价必须跑脚本定量（TCO/EAC、临界故障率、溢价ROI、公允价格上限），并审计制造商是自产还是代工贴牌、质量与售后谁兜底，最后用夯/顶级/人上人/NPC/拉五级梯队直观排序，结论先行给唯一推荐，没有可靠选项直说「目前没有」。触发词：想买XX、买什么、求推荐、对比、值不值得买、避坑、扫雷、性价比、质价比、溢价、历史低价、好价、预算XX买什么、哪个牌子靠谱、是不是贴牌、代工、梯队。English: anti-astro-turfing shopping advisor — evidence-graded product vetting with manufacturer/ODM audit and a 5-tier ranking, use when the user asks what to buy or whether something is worth it." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
ΔEACFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.No other findings across 996 lines in 7 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.