cue-journal-draft@0.15.27

CAUTION

Publisher claims: "给你栏目 + 本期素材（或先做公开检索），产出可编辑成稿：提纲、成稿、引证逐条回源，后接版面与编辑定位两道脚本门禁（查定位落地、字数、读者动作、句长、自填 taboo 词表与术语密度），终了 QA 清单人工逐项核（引证回源、极限词在清单内）。仿写参考样式只学语气、不编事实。适合：月刊/季刊内刊、客户通讯、投资者信、ESG 特刊。不适合：替代编辑签发（门禁给清单、拍板在用户）、编造客户案例、承诺刊发效果。 Do NOT use for: editorial sign-off, invented client cases, promised outcomes." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huhoo · joined 2 days agoInstalls 44Last detonated 41 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packageCHANGELOG.md:197 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.en.md:72 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionCHANGELOG.md:201 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagereferences/cue-onboarding.md:53 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:86 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:216 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsCHANGELOG.md:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageCHANGELOG.md:5 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsCHANGELOG.md:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Python subprocess execution detectedscripts/check_derived_sync.py:224 · Python subprocess execution detected

AST05

CRITICAL

Access to sensitive file pathsCHANGELOG.md:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05