cha2a-phone@1.0.0
VERIFIED· install onlyPublisher claims: "仅在用户明确要求使用 CHA2A / agent 电话能力时激活——例如明确提及 cha2a-phone、dsh-phone， 或明确要求"给 agent 发短信 / 发 RCS 群消息 / 把图片发到电话或群组 / 电话开户注册 / 核验 agent 号码或信任等级"。不因日常提到"打电话 / 发消息"等通用词而激活。 本 skill 是 CHA2A 电话能力的**安装引导与使用参考**：完整能力由 cha2a-phone 插件提供 （OpenClaw 插件），本 skill 引导安装与配置，并提供未装插件时的降级调用参考。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 249 lines in 3 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.