Skills/ClawHub/code-spec-guardian

code-spec-guardian@1.3.1

VERIFIED· install only

Publisher claims: "项目代码规范守护者 — 分析/沉淀/执行项目规范，分模块按需加载，支持自进化。 支持前端(Vue/React/Next/Nuxt/Angular/Svelte)、Node.js、Python(Django/Flask/FastAPI)、 Java(Spring Boot/Spring Cloud)、Go(Gin/Echo/Fiber)、PHP(Laravel)、Rust 等多语言多框架。 自动检测项目语言生态，路由到对应分析指引文件。 触发词：分析项目规范|查看/检查规范|生成/修改/修复代码|写组件/页面/接口/API/服务/ SQL/数据库|重构/优化代码|Code Review|新建项目/初始化项目|规范review|代码review| 按项目规范|code style|code spec|项目用什么风格/技术栈/架构|项目规范是什么| 写一个XX|帮我写XX|新增XX功能|新建XX页面|这个XX怎么改|修复这个XX| 当 .code-spec/ 存在时自动生效，代码输出受规范约束。 Project code spec guardian — multi-language. Analyzes conventions, auto-loads specs. Triggers: analyze specs, show specs, write code per spec, fix bug, refactor, code review, write component/page/API/service/SQL. Multi-language support: Vue, React, Next, Nuxt, Angular, Svelte, Node.js, Python, Java, Go, PHP, Rust." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher gmmg55 · publishing for 108 daysInstalls 935Last detonated 4d ago
$clawhub install code-spec-guardian
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

LOW
Instructs the agent to modify its persistent memory or instruction filesskill-card.md:53 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file**Other Properties Related to Output:** [May create or update `.code-spec/` files and may update `AGENTS.md` after initial analysis when auto-loading guidance is desired.]Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesskill-card.md:25 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileRisk: The skill can update `AGENTS.md`, which can change how future agents behave in the repository.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈1,428 tok
1 file · 31 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.