kugou-skill@0.1.20
VERIFIED· install onlyPublisher claims: "酷狗，酷狗音乐，酷狗skill，酷狗音乐skill，酷狗音乐助手 提供歌曲搜索、猜你喜欢、相似推荐、收藏管理、听歌统计、酷狗榜单、创建歌单、调整音乐偏好等功能。 **触发场景**（满足任一即使用本技能）： - 用户要求推荐歌曲、听歌建议 - 用户要求搜索歌曲、查找歌手作品 - 用户要求查看音乐榜单（飙升榜、TOP500、抖音热歌等） - 用户要求查看收藏、最近播放、听歌统计 - 用户要求创建歌单、自建歌单 - 用户要求调整音乐偏好（"少推点 XX 歌手"、"多推点 XX 语种"、"别再推 XX 曲风" 等） - 用户提供 base64 secret 字符串要求登录或导入身份 - Agent" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 2,486 lines in 9 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.