hub-kb@1.0.0

VERIFIED

Publisher claims: "代理客户端知识库。用户问 Clash Verge Rev、Clash Party、FlClash、v2rayN、v2rayNG、Clash Meta for Android、sing-box、Karing、Shadowrocket 等代理客户端或 mihomo、Xray 内核的问题时使用:订阅、节点、协议、分流规则、TUN(虚拟网卡)、系统代理是什么,客户端与内核的版本、更新、下载(含预发布与 autobuild)怎么选,想完成导入订阅、切换节点等操作,或遇到节点为空、订阅更新失败、连上但打不开网页等问题(附截图求助也算);用户问推荐或比较机场、服务商(含宽带运营商)、服务商(机场、VPS / 云服务器商)的账号与售后(续费、退款、封号,含服务商自己的群组与频道)、服务端搭建与运维(VPS、面板、xray / sing-box 服务端)时同样使用(按规则只回一句固定话)。只读,不读取用户机器状态,不写入。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher ladderkit · joined 0 days agoInstalls 130Last detonated 2 h ago
$clawhub install hub-kb
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionindex-min.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandindex-min.json:1 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
hub-kb@1.0.0 safety verdict: Verified 87/100 — KillerSkills