cue-tear-sheet@0.1.19

CAUTION

Publisher claims: "给你一家公司（名或代码），产出一页速览五段：身份三行（主营句取披露原文、禁自造简介）；近四期速览（营收/归母/扣非/经营现金流，累计+单季双口径带标签）；在场事件 ≤4 条（先过入类第一闸：明确披露日期或 statute 锚内条件可判）；风险 1–3 条仅收直查命中，无命中必写固定句「直查面内未命中≠无敞口」；观点区 [待人工] 空三行、一字不代填。默认零深研：有深研诉求即标注「深研未发起」转姊妹件，不中途发起。适合：初次接触一家公司、会前速备。不适合：深度尽调（转 dd-checklist）、投资意见。 Do NOT use for: investment advice." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huhoo · joined 2 days agoInstalls 42Last detonated 41 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsCHANGELOG.md:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsCHANGELOG.md:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsCHANGELOG.md:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.en.md:37 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:37 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageCHANGELOG.md:5 · npx invocation of non-well-known package — may execute untrusted code

AST06