ljh-yinzi@1.0.0
VERIFIED· install onlyPublisher claims: "内容因子工具。三种模式：拆解（把一条爆款素材拆到因子级）、排序（给候选专攻课题按 EV 打分排优先级并跑完整 SOP）、建库（指导搭建因子库三张表）。 触发方式：/ljh-yinzi、「帮我拆一条爆款」「这几个方向该先做哪个」「怎么搭因子库」 Content-factor toolkit for short-video e-commerce. Three modes: decompose a viral video into factors, rank candidate focus topics by expected value, or build a reusable factor library. Trigger: /ljh-yinzi, "break down this viral video", "which topic should I focus on first", "help me build a factor library" 学术论文结构拆解、金融因子模型这类非内容电商场景，不要自动触发。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 442 lines in 2 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.