Skills/ClawHub/ima-mcp-cos-upload

ima-mcp-cos-upload@1.0.3

VERIFIED

Publisher claims: "WorkBuddy ima-mcp 知识库入库的 COS 直传方案：create_media → HMAC-SHA1 签名 → curl PUT → add_knowledge。含两处致命签名坑（尾随\n、header 值 safe=''）与'委托子代理避免 token 损坏'稳路。触发：ima 推库/上传 md/pdf/ppt 到知识库报 COS 403。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dzz-777 · joined 5 days agoInstalls 281Last detonated 5d ago
$clawhub install ima-mcp-cos-upload
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 93/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

No findings across 213 lines in 2 files.