Skills/ClawHub/idea-doctor

idea-doctor@0.2.5

CAUTION· static only

Publisher claims: "商业点子可行性评估：八维评分卡＋三情景经济账，算得出值不值得，给 Go/Pivot/Kill 判定" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher linkkhub-pixiu · publishing for 10 daysInstalls 210Last detonated 25 min ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
URL with suspicious TLDSKILL.md:115 · URL with suspicious TLD — commonly used for phishing/malware- 2026-11-14 · **v0.2.2**：端点已开放口径对齐——体检端点 `https://linkkhub.top/idea/generate` 确认在服（POST 空 body→422 `INVALID_INPUT` fail-close 零建单），全文「预留未开放」口径同步为已开放口径；随包脚本字节零动。Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDSKILL.md:13 · URL with suspicious TLD — commonly used for phishing/malwarenetwork: 端点已于 2026-11-14 对外开放（来源：发布方验证记录 2026-11-14）；提交生成需访问唯一服务端点 https://linkkhub.top/idea/generate；自动预备（第 0.5 步）阶段的联网搜索是用户侧智能体在用户授权下的本机行为，非本技能脚本发起；除此之外不发起任何网络请求（自动预备节口径不变）Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionscripts/questionnaire.json:2 · File type combined with upload action — agent may exfiltrate local data files{ "_desc": "商业点子体检官问卷模板（壳包 v0.2.4）。复制本文件为 my_questionnaire.json 后填 _input；ideas 数组 1-10 条：1 条 ¥4.9，2-10 条 ¥9.9，>10 拒单（服务端 400 BATCH_TOO_LARGE：一次最多 10 个点子…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL with suspicious TLDSKILL.md:93 · URL with suspicious TLD — commonly used for phishing/malware…成、退款规则**未实查官方文档前不对外承诺任何具体条款**（来源与检索日期须实查官方文档后补记）。 3. **端点开放口径**：生成引擎与服务层已实装，端点 `https://linkkhub.top/idea/generate` 已于 2026-11-14 对外开放（来源：发布方验证记录 2026-11-14：POST 空 body 命中 422 `INV…Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDscripts/submit_report.js:127 · URL with suspicious TLD — commonly used for phishing/malware// [变更记录 2026-11-12 · v0.2.0] 新基线首版；端点 https://linkkhub.top/idea/generate。Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDSKILL.md:33 · URL with suspicious TLD — commonly used for phishing/malware提交脚本只访问唯一端点 https://linkkhub.top/idea/generate；自动预备（第 0.5 步）阶段的联网搜索是用户侧智能体在用户授权下的本机行为，非本技能脚本发起；页面、账单与该端点之外无任何外呼。Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDscripts/submit_report.js:20 · URL with suspicious TLD — commonly used for phishing/malwareconst ENDPOINT = 'https://linkkhub.top/idea/generate';Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈1,867 tok
1 file · 4 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim linkkhub-pixiu: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  3. URL with suspicious TLD≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim linkkhub-pixiuPropose a patch to the maintainer