Skills/ClawHub/mac-disk-audit

mac-disk-audit@1.0.2

CAUTION

Publisher claims: "Mac 硬盘又满了？磁盘空间不足不知道删什么？我想清理 Mac 但怕误删系统文件？Mac磁盘清理顾问（mac disk audit / mac cleanup / disk space analyzer / 磁盘清理 / 大文件扫描 / 空间分析）是一个 AI 辅助的磁盘清理工具：自动扫描系统目录、用户目录与开发项目，按体积排序定位谁在吃你的磁盘（Xcode 缓存 / node_modules / 旧项目 / 大文件 / 重复文件），生成三级清理建议（立即清 / 确认后清 / 保留）与可直接复制执行的命令，形成「扫描 → 分级 → 执行」的安全清理 workflow。当用户说「硬盘不够用」「空间不足」「磁盘快满了」「帮我清理 Mac」「扫描大文件」「哪些文件可以删」「如何释放磁盘空间」时触发。Use when your Mac is running out of disk space and you want a safe, review-first cleanup plan. 绝不自动删除任何文件——只出报告和命令，执行前必须用户确认。触发词：磁盘清理、空间不足、大文件、清理Mac、mac cleanup、disk space、free up space。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher guipi888 · joined 4 days agoInstalls 496Last detonated 2 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

CRITICAL
Destructive file system command detectedSKILL.md:169 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Privileged sudo commandSKILL.md:169 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Destructive file system command detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Privileged sudo command≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Unclaimed publisher≈ +8 on the totalClaim guipi888: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim guipi888