Skills/ClawHub/key

key@1.0.0

VERIFIED

Publisher claims: "AI KEY·短命令 ——AI KEY（AI 钥匙）工具箱的短命令。`/key` 和 `/aikey` 完全一样，只是少敲三个字母 —— 它把你交给总入口，由总入口按你卡在哪挑技能。 两套技能：做内容（选题 / 写稿 / 标题 / 开头 / 审核 / 剪辑 / 复盘）· 看生意（营收归因 / 大客户集中度 / 依赖风险 / 多产品线取舍 / 目标拆路径 / 趋势押什么 / 决策 / 到期追踪）。 触发方式：/key、/key 新手指南、/钥匙 ⚠️ **与 API key、密钥、密码、令牌无关**。用户问的是接口密钥、环境变量、凭据一类的事，**不要用本技能**。 Short command for the AI KEY toolbox: `/key` is the same entry point as `/aikey`. Not about API keys, secrets or credentials. Trigger: /key, "/key 新手指南" —— AI KEY · 不给公式，给判据。每条规则都标了实测代价。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher iamzifei · joined 6 days agoInstalls 264Last detonated 4d ago
$clawhub install key
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-30 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:34 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

No other findings across 101 lines in 2 files.