Skills/ClawHub/cue-sector-overview

cue-sector-overview@0.1.30

CAUTION

Publisher claims: "给你行业名 + 时间窗，产出六节固定的景气度报告：分析维度不背框架库，每次由深研按行业类型动态生成 2–4 个再取数；交付的是带可比序列锚的行业冷热证据，不是观点成品——判断词当场可答凭哪条序列、哪个口径、截至哪天，附代表 A 股公司清单与覆盖缺口。「看好哪个行业」式建议不做：评级词零容忍。适合：行业研究开题、会前准备、尽调的行业章节（与 dd-checklist 公司维度互补）。不适合：荐股择时、承诺非公开数据覆盖。 Do NOT use for: stock picks or timing, promises of non-public coverage." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huhoo · joined 2 days agoInstalls 110Last detonated 17 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsCHANGELOG.md:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsCHANGELOG.md:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsCHANGELOG.md:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:45 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:38 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.en.md:41 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageCHANGELOG.md:109 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.en.md:35 · npx invocation of non-well-known package — may execute untrusted code

AST06