hanzi-center@1.0.1
CAUTION· static onlyPublisher claims: "雄韬汉字视觉重心分析引擎——基于"分量·距离·斜度"三要素模型，融合启功结字黄金律与阿恩海姆视知觉理论，对任意汉字进行像素级视觉重心计算。当用户问及汉字重心、书法结构、字体平衡、"这个字为什么看起来歪"、中宫收紧、结字法则、不同字体的重心差异时使用。支持楷/宋/黑/仿/明/思源6种字体切换、多字对比、中宫热力分析..." Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
> 🌐 **在线演示**：[http://shufa.xtocn.com/汉字视觉重心.html](http://shufa.xtocn.com/%E6%B1%89%E5%AD%97%E8%A7%86%E8%A7%89%E9%87%8D%E5%BF%83.html)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.No other findings across 1,461 lines in 5 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim xtoyun: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Dense URL-encoded content≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.