flat-lay@1.0.25

CAUTION

Publisher claims: "服装平铺图一键上身试穿。服装平铺图 + 姿势参考图 → 模特上身商拍图，款式、颜色、织法、版型保持不变。当用户说「平铺图转模特图」「衣服上身」「虚拟试穿」「AI 试衣」「让模特穿上」时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dlazyai · joined 2 days agoInstalls 1,643Last detonated 41 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsscripts/gen.mjs:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsscripts/lib/providers.mjs:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Fake instruction boundary tagreferences/model-flags.md:13 · Fake instruction boundary tag

AST01

CRITICAL

Fake instruction boundary tagreferences/provider-cli.md:130 · Fake instruction boundary tag

AST01

HIGH

npx invocation of non-well-known packagereferences/provider-cli.md:68 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagescripts/brand.mjs:97 · npx invocation of non-well-known package — may execute untrusted code

AST06