huo15-huihuo-suite@1.8.0
CAUTIONPublisher claims: "Use this skill whenever the user wants to manage their work in the 火一五/辉火云 company Odoo system (www.huo15.com, db=huo15) — to-dos / tasks ("记个待办" "加任务" "我的待办"), projects, timesheets ("记工时"), CRM leads & opportunities ("新建商机" "跟进客户" "销售管道"), follow-up activities & reminders ("提醒我" "3天后回访"), calendar events & meetings ("安排会议" "我这周日程" "提前30分钟提醒"), knowledge-base articles ("查/写知识库" "产品手册"), or document files ("找文档" "上传文件"). Also accounting ("发票" "账单" "付款" "科目"), and HR operations — employees ("员工" "部门"), attendance ("考勤" "签到" "签退"), time off ("请假" "休假"), expenses ("报销"). Also a one-stop "我今天/本周要做什么" briefing. Triggers on odoo, 辉火云企业套件, 公司系统, /odoo/to-do /project /timesheets /crm /calendar /knowledge /documents /sale /purchase /inventory /invoices /hr, or "登录公司系统/保存 odoo 账号". Treat bare work-context mentions of 待办/任务/项目/工时/客户/商机/会议/日程/提醒/知识库/文档/销售/采购/库存/订单/发货/收货/发票/账单/付款/科目/员工/部门/考勤/签到/签退/请假/休假/报销 as this skill. First run: login.py init (地址/数据库/账号/认证方式/凭据 → ~/.huo15/tools.md). Pure standard library, zero dependencies. 推荐使用 API Key（Odoo 用户设置→安全→API密钥→新增）而非登录密码。" Observed in sandbox: static analysis only — behavior not yet observed.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-06 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
No findings across 9,273 lines in 37 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim zhaobod1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.