hekouwang-env-doctor-skill@1.2.2
CAUTION· install onlyPublisher claims: "会勇禾口王 · 开发环境体检器（第三把 doctor）。扫描 Mac/Linux 上被开发工具占掉的磁盘空间，把每个目录判定成「数据 / 缓存 / 残留」三类，重点识别**你已经换掉但从没卸干净的旧工具**（如还留着 nvm 却早就在用 fnm），逐条给出判定依据、官方清理命令与代价。配交互式清理选择器（空格勾选、数据类锁死勾不上、确认后才执行、支持 --dry-run），删什么由你逐项勾。触发：用户说「磁盘满了 / 硬盘不够了 / 清理缓存 / 电脑越用越满 / 开发环境体检 / 查查什么占空间 / env-doctor / 环境体检 / disk doctor / 我的 Mac 空间去哪了 / node_modules 太大 / 缓存清理 / 残留清理 / 换过 nvm 想清干净」。任何「查/清 本机磁盘被开发工具占用」的请求都应触发。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive command against a filesystem root or device; Destructive command against a filesystem root or device; Destructive command against a filesystem root or device. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
"residue|$HOME/.nvm|nvm（node 版本管理器）|rm -rf \"\$HOME/.nvm\"|以后要用 nvm 需重装；记得删 shell 里 NVM_DIR 那几行"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.pyenv|pyenv（python 版本管理器）|rm -rf \"\$HOME/.pyenv\"|以后要用 pyenv 需重装；记得删 shell 里 pyenv init 那几行"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.rbenv|rbenv（ruby 版本管理器）|rm -rf \"\$HOME/.rbenv\"|同上，注意 shell 配置"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.rbenv|rbenv（ruby 版本管理器）|rm -rf \"\$HOME/.rbenv\"|同上，注意 shell 配置"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.asdf|asdf（多语言版本管理器）|rm -rf \"\$HOME/.asdf\"|同上，注意 shell 配置"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.nvm|nvm（node 版本管理器）|rm -rf \"\$HOME/.nvm\"|以后要用 nvm 需重装；记得删 shell 里 NVM_DIR 那几行"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.asdf|asdf（多语言版本管理器）|rm -rf \"\$HOME/.asdf\"|同上，注意 shell 配置"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.volta|volta（node 工具链）|rm -rf \"\$HOME/.volta\"|同上，注意 shell 配置"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.pyenv|pyenv（python 版本管理器）|rm -rf \"\$HOME/.pyenv\"|以后要用 pyenv 需重装；记得删 shell 里 pyenv init 那几行"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.# ⛔ 铁律：本脚本【只读】。全文不含 rm / rmdir / trash / unlink / mv / truncate 等任何破坏性命令。Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell."residue|$HOME/.volta|volta（node 工具链）|rm -rf \"\$HOME/.volta\"|同上，注意 shell 配置"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Unclaimed publisher≈ +8 on the totalClaim huiyonghkw: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.