metadig-skills@1.0.0
VERIFIEDPublisher claims: "用 metadig 命令行调用 MetaDig（元界深掘，waytometa.cn）平台生成 AI 图片、视频、语音（TTS）和音乐，产物自动落到用户的网页画布项目。当用户要出图、出片、配音、配乐、批量生成素材、查询可用模型与积分价格、查生成任务进度，或提到 metadig / MetaDig / 元界深掘 / waytometa 时使用。Use when the user wants AI images, videos, speech or music generated through MetaDig, or mentions the metadig CLI." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-31 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
MEDIUM
Remote installer piped to shellSKILL.md:24 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07HIGH
Pipe-to-shell patternSKILL.md:24 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06