etf-fund-query@1.0.5
VERIFIEDPublisher claims: "ETF（交易型开放式指数基金）信息与行情查询。ETF 在证券交易所上市交易，通常通过券商股票账户买卖，盘中按交易价格成交，以6位证券代码识别（如510300）。 支持查询ETF基础信息、规模费率、持仓明细、历史分红、区间收益、资金流向、涨幅榜、热搜榜、按持仓股票反查相关ETF，以及最新价、盘中涨跌、成交、换手率、IOPV、溢折率和分钟走势。 适用于用户关注场内ETF基础信息、成交活跃度、主题ETF筛选、同类ETF比较和实时行情等场景。如果用户通过银行、基金公司或第三方基金销售平台申购赎回指数基金，应使用 open-fund-query；如果用户查询指数本身，应使用 index-query。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 90/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/basename
0.1sprocessexec /usr/bin/mkdir
0.1sprocessexited 1:
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
Static findings
MEDIUM
File permission modification commandinstall.sh:159 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandinstall.sh:154 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandinstall.sh:156 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05