likeadmin-market-skills@1.1.0
VERIFIED· install onlyPublisher claims: "基于配置安全调用算力超市完整模型应用与任务开放接口" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 91/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actionreferences/capability-catalog.json:7959 · File type combined with upload action — agent may exfiltrate local data files
AST07"contract_file": "contracts.bundle.json#music-generation-upload-audio",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionreferences/capability-catalog.json:5414 · File type combined with upload action — agent may exfiltrate local data files
AST07"contract_file": "contracts.bundle.json#open-api-upload",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Collapsed <details> block carrying instructionsreferences/contracts.bundle.json:202 · Collapsed <details> block carrying instructions · informational: not an instruction file
AST01\n<summary>基本信息</summary>\n\n| 字段 | 内容 |\n| --- | --- |\n| 类型 | 模型 API |\n| 模型名称 | GPT Image 2 Pro |\n| 模型编码 | `gpt-image-2-pro` |\n| 模型类型 | 图片生成（image） |\n| 调用Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Collapsed <details> block carrying instructionsreferences/contracts.bundle.json:148 · Collapsed <details> block carrying instructions · informational: not an instruction file
AST01\n<summary>基本信息</summary>\n\n| 字段 | 内容 |\n| --- | --- |\n| 类型 | 模型 API |\n| 模型名称 | Nano-Banana Pro |\n| 模型编码 | `nano-banana-pro` |\n| 模型类型 | 图片生成（image） |\n| 调用Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Collapsed <details> block carrying instructionsreferences/contracts.bundle.json:130 · Collapsed <details> block carrying instructions · informational: not an instruction file
AST01\n<summary>基本信息</summary>\n\n| 字段 | 内容 |\n| --- | --- |\n| 类型 | 模型 API |\n| 模型名称 | Nano-Banana 2 |\n| 模型编码 | `nano-banana-2` |\n| 模型类型 | 图片生成（image） |\n| 调用方式 |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Collapsed <details> block carrying instructionsreferences/contracts.bundle.json:184 · Collapsed <details> block carrying instructions · informational: not an instruction file
AST01\n<summary>基本信息</summary>\n\n| 字段 | 内容 |\n| --- | --- |\n| 类型 | 模型 API |\n| 模型名称 | GPT Image 2 |\n| 模型编码 | `gpt-image-2` |\n| 模型类型 | 图片生成（image） |\n| 调用方式 | `POFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Collapsed <details> block carrying instructionsreferences/contracts.bundle.json:220 · Collapsed <details> block carrying instructions · informational: not an instruction file
AST01\n<summary>基本信息</summary>\n\n| 字段 | 内容 |\n| --- | --- |\n| 类型 | 模型 API |\n| 模型名称 | GPT Image 2 Fast |\n| 模型编码 | `gpt-image-2-fast` |\n| 模型类型 | 图片生成（image） |\n| Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Collapsed <details> block carrying instructionsreferences/contracts.bundle.json:166 · Collapsed <details> block carrying instructions · informational: not an instruction file
AST01\n<summary>基本信息</summary>\n\n| 字段 | 内容 |\n| --- | --- |\n| 类型 | 模型 API |\n| 模型名称 | GPT Image 2 |\n| 模型编码 | `gpt-image-2` |\n| 模型类型 | 图片生成（image） |\n| 调用方式 | `POFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈1,986 tok
1 file · 14 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.