index-query@1.0.7
VERIFIEDPublisher claims: "证券指数信息与行情查询。指数用于反映一组证券的整体表现，是市场基准，不是可直接申购赎回的基金产品，通常以6位指数代码识别。 支持查询指数基础信息、分类、编制属性、成分股、行业和市值分布、区间收益、波动与回撤、PE/PB/PS估值及历史分位、ROE、股息率、营收和利润增速、相关ETF或场外基金，以及最新点位、涨跌、成交和分钟走势。 适用于用户关注沪深300、中证500、红利、行业或主题指数的检索筛选、成分股反查、指数比较、估值基本面和实时行情等场景。如果用户查询具体ETF产品，应使用 etf-fund-query；如果用户查询具体场外指数基金，应使用 open-fund-query。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 90/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/basename
0.1sprocessexec /usr/bin/mkdir
0.1sprocessexited 1:
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
Static findings
MEDIUM
File permission modification commandinstall.sh:154 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandinstall.sh:159 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandinstall.sh:156 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05