Skills/ClawHub/inspection-balloon-annotator

inspection-balloon-annotator@1.0.0

VERIFIED

Publisher claims: "机械图纸(矢量/扫描PDF或图片)检验气泡标注一体化工具：生成红色圆圈+编号的"检验气泡标注图"(PDF+PNG)，并产出单一合并检验表(5 sheet：检验记录表/标注图纸(气泡图)/未注公差基准/汇总/关键特性专项)。当用户要求"做气泡图/检验气泡图""标关键尺寸/形位公差""生成检验表/首件检验清单(FAI)/全尺寸检验报告/IQC-OQC检验表""尺寸与公差 Excel 报表"时使用。自动高分辨率渲染、多方向OCR精确定位、编号自动避让+吸附、一般公差(GB/T1804-f / GB/T1184-H)套用、覆盖性自检。关键词：检验气泡图 气泡标注 首件检验 FAI 全尺寸检验 品质QC" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher zl19851022-commits · joined 6 days agoInstalls 167Last detonated 6d ago
$clawhub install inspection-balloon-annotator
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionSKILL.md:104 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/batch_run.py:13 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/gen_excel.py:3 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:66 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_balloons.py:6 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/gen_combined.py:12 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/gen_combined.py:11 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:173 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:97 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/auto_run.py:67 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/gen_qc_items.py:5 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/gen_qc_items.py:4 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07