mihomo-skill@1.0.0
VERIFIED· install onlyPublisher claims: "诊断并修复 mihomo / Clash.Meta / Clash 内核的代理异常，与部署平台无关——本机、远程 Linux/VPS、Docker、软路由/OpenWrt、群晖/绿联等 NAS、Clash Verge Rev / Mihomo Party 桌面客户端都适用。出现「代理时好时坏、节点全部延迟超时、面板全红、订阅拉不下来、日志 pull error、国内能上境外全断、重启后突然不能翻墙、明明有节点却像没走代理、分流或自动切换不生效、需要多订阅互为主备」时使用。覆盖 DNS 污染、SNI 阻断、订阅激活、provider 死锁、fallback 套策略组、GEOIP 误判直连等根因，可直接备份改配置、热重载或重启并复检。关键词：mihomo、clash、clash-meta、clash verge、mihomo party、proxy-provider、订阅、节点超时、分流规则、自动切换、主备、SNI 阻断、DNS 污染、docker、软路由、openwrt、nas、绿联、群晖、systemd。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 89/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
code=$($CURL -s -o /tmp/_mh_reload.txt -w '%{http_code}' -m 20 -X PUT \Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.out = subprocess.run(cmd, capture_output=True, text=True, timeout=8).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.# bash diagnose.sh --api http://192.168.1.2:9090 --secret 'xxx'Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.