ccdb@1.0.0
VERIFIED· install onlyPublisher claims: "碳阻迹（Carbonstop）CCDB 碳排放因子与排放系数查询、比较和匹配。当用户需要电力、天然气、柴油、汽油、煤炭、水泥、钢材、铝材、塑料、运输、包装或食品等活动与材料的真实排放因子（emission factor），或为产品碳足迹（PCF / carbon footprint）、企业碳核算及生命周期评价（LCA）查找和选择因子时使用。支持按国家/地区、年份等条件检索，核对单位、系统边界、技术规格及数据来源，并比较候选因子的适用性。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 92/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
npm install -g ccdb-cli@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.No other findings across 148 lines in 2 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.