Skills/ClawHub/cue-paper-study-cn

cue-paper-study-cn@0.2.26

CAUTION

Publisher claims: "学术论文研读包：给你一篇 PDF/链接，产出五段研读卡——观点逐句挂页码锚、复现清单（数据/代码/参数缺口如实标）、引用网络只列检索到的、综述脚手架留你自己的论点槽。适合「这篇论文讲什么」「帮我读这篇 PDF」「综述取材」「引用对不对」等场景。Do NOT use for: 代写或降重改写论文、编造不存在的引文与结论、替你做学术评价。Triggers: 论文研读 / 读这篇 PDF / 文献速览 / 综述骨架 / 引用核对 / 复现清单； paper reading / literature review scaffold" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huhoo · joined 2 days agoInstalls 89Last detonated 31 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsCHANGELOG.md:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Python subprocess execution detectedscripts/check_study_card.py:333 · Python subprocess execution detected

AST05

HIGH

npx invocation of non-well-known packageREADME.md:77 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:108 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.en.md:110 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Destructive file system command detectedREADME.en.md:174 · Destructive file system command detected

AST05

HIGH

npx invocation of non-well-known packageREADME.en.md:78 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.en.md:79 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Destructive file system command detectedREADME.en.md:12 · Destructive file system command detected

AST05

CRITICAL

Access to sensitive file pathsCHANGELOG.md:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageCHANGELOG.md:111 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:76 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsCHANGELOG.md:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05