career-planner-china@2.3.6
VERIFIED· install onlyPublisher claims: "AI时代职业规划师技能。专为AI时代职场变化而设计，帮助用户应对AI带来的职业冲击与机遇。当用户询问职业规划、职业建议、选专业、职场转型、未来就业方向时触发。功能包括：收集用户基本信息、霍兰德职业兴趣测评、职业价值观分析、AI时代职业影响评估（高危/中危/低危分级），并输出完整的个性化职业规划报告。关键词：职业规划、选专业、工作建议、做什么工作好、职业转型、AI时代职业、AI替代、哪些工作会被AI取代。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 88/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
r2 = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out."https://baike.baidu.com/item/%E5%AE%89%E5%BF%83%E8%B4%A2%E4%BA%A7%E4%BF%9D%E9%99%A9%E6%9C%89%E9%99%90%E8%B4%A3%E4%BB%BB%E5%85%AC%E5%8F%B8/19407012",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own."https://baike.baidu.com/item/%E6%B3%B0%E5%BA%B7%E5%9C%A8%E7%BA%BF%E8%B4%A2%E4%BA%A7%E4%BF%9D%E9%99%A9%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8/19407033",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own."https://baike.baidu.com/item/%E5%AE%89%E5%BF%83%E4%BF%9D%E9%99%A9/17936073",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out."https://zh.wikipedia.org/zh-hans/%E4%BC%97%E5%AE%89%E4%BF%9D%E9%99%A9",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own."source_url": "https://baike.baidu.com/item/%E5%AE%89%E5%BF%83%E8%B4%A2%E4%BA%A7%E4%BF%9D%E9%99%A9%E6%9C%89%E9%99%90%E8%B4%A3%E4%BB%BB%E5%85%AC%E5%8F%B8/19407012",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.r = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.