cite-holmes@6.5.0
VERIFIED· install onlyPublisher claims: "Deep research with machine-verified citations" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher docsor1212 · publishing for 92 daysInstalls 2,627Last detonated 36 min ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
Python subprocess execution detectedtests/test_v60100.py:160 · Python subprocess execution detected
AST05r = subprocess.run([sys.executable,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_v60200.py:68 · Python subprocess execution detected
AST05rc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Privileged sudo commandtests/test_v120.py:222 · Privileged sudo command — agent may execute with elevated privileges
AST05"sudo ", "set" + "uid", "StrictHost" + "KeyChecking"]Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_v60300.py:26 · Python subprocess execution detected
AST05r = subprocess.run([sys.executable, NETCHECK, "--help"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtools/selfcheck.py:108 · Python subprocess execution detected
AST05rc = subprocess.run([sys.executable, mcp_engine, "--demo", "--offline",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtools/selfcheck.py:118 · Python subprocess execution detected
AST05rc = subprocess.run(["bash", rt, "--shipped"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtools/selfcheck.py:71 · Python subprocess execution detected
AST05rc = subprocess.run([sys.executable, ENGINE, "--refs", demo,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagetools/agentskills_check.py:99 · npx invocation of non-well-known package — may execute untrusted code
AST06# npx skillsadd <owner/repo> 安装；agentskills.io 为开放标准规范）Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedtools/netcheck.py:62 · Python subprocess execution detected
AST05p = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagetools/agentskills_check.py:102 · npx invocation of non-well-known package — may execute untrusted code
AST06" .claude/skills/<name>/ 均可被发现；安装 npx skillsadd <owner/repo>")Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedtests/test_v60500.py:124 · Python subprocess execution detected
AST05r = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_v60500.py:174 · Python subprocess execution detected
AST05r = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈3,791 tok
1 file · 85 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.