Skills/ClawHub/industry-radar

industry-radar@1.1.0

CAUTION

Publisher claims: "行业雷达（Industry Radar）——可本地部署的「行业 × 技术」情报简报生成引擎（FastAPI 后端 + Vue Web 界面 + REST API），围绕「行业词 × 技术词」完成多源 RSS 采集、全文抽取、simhash 去重、相关性打分、主题聚类、LLM 摘要（未配置 LLM 自动降级），产出编辑精选式结构化简报。仅当用户点名本产品（「行业雷达」「Industry Radar」「IndustryRadar」「智汇简报」），或明确要求「用行业 × 技术关键词组合生成多源 RSS 情报简报 / 周报」时使用。触发必须先命中产品名或「行业词 × 技术词 × RSS 采集生成简报」这一复合意图；仅出现泛化的周期报告、监控、订阅管理、RSS 等词汇时不触发——用户写工作总结、做通用信息聚合、询问 RSS/Atom 概念、或搭建其他监控系统时不要使用本 Skill。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher morningstar-lu · joined 0 days agoInstalls 218Last detonated 7 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-03 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Outbound HTTP to raw IP address; Outbound HTTP to raw IP address; Outbound HTTP to raw IP address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Outbound HTTP to raw IP addressscripts/run_local.py:10 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressscripts/run_local.py:16 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:74 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
URL with embedded credentialsapp/backend/net_guard.py:14 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL using raw IP addressSKILL.md:75 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/run_local.py:84 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addressSKILL.md:74 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/run_local.py:45 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Outbound HTTP to raw IP addressapp/backend/net_guard.py:8 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:75 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressapp/backend/net_guard.py:8 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressscripts/run_local.py:17 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/run_local.py:17 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/run_local.py:16 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressscripts/run_local.py:10 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim morningstar-lu: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim morningstar-lu