Skills/ClawHub/chore-system-upgrade

chore-system-upgrade@1.5.0

VERIFIED· install only

Publisher claims: "小红书 / Xiaohongshu / RedNote AI Agent Skill。用 Python Playwright 搜索和读取内容、管理登录会话、发布图文/视频/长文、评论、点赞和收藏；默认输出 JSON，任何写操作都必须先获得用户确认。用户提到 xiaohongshu、小红书、rednote、小红书搜索、发到小红书、小红书笔记分析、小红书运营或小红书自动化时触发。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher deliciousbuding · publishing for 83 daysInstalls 388Last detonated 6d ago
$clawhub install chore-system-upgrade
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagescripts/site_check.py:104 · npx invocation of non-well-known package — may execute untrusted codeif "skills.sh" not in html or "npx skills add DeliciousBuding/xiaohongshu-skill" not in html:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandDockerfile:22 · File permission modification command — agent changes file ownership/permissions&& chown -R app:app /app /home/app/.xiaohongshu /ms-playwrightFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/quality.py:20 · Python subprocess execution detectedreturn subprocess.run(command, env=None if env is None else dict(env), check=False).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/site_check.py:140 · npx invocation of non-well-known package — may execute untrusted code"npx skills add DeliciousBuding/xiaohongshu-skill",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetests/test_site_check.py:80 · npx invocation of non-well-known package — may execute untrusted code<body>skills.sh npx skills add DeliciousBuding/xiaohongshu-skill AgentSkill ClawHub Claude Code Codex OpenClaw</body>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Dense URL-encoded contenttests/test_search.py:22 · Dense URL-encoded content — may be obfuscating payloadsassert "keyword=%E6%B5%8B%E8%AF%95" in urlFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈1,104 tok
2 files · 90 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.