my-halala-sales-vp@1.1.1
VERIFIED· install onlyPublisher claims: "Personal private test skill for halala sales-vp experiments. Use only when the owner explicitly asks for my-halala / halala sales workflow. Not a general-purpose public tool." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsscripts/qianlima_qr_login.py:166 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env_default = os.environ.get("QIANLIMA_ENV", "").strip() or str(workdir / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/qianlima_qr_login.py:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05print("[登录] 新授权已安全写入 .env，二维码已删除")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/qianlima_qr_login.py:170 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05help="写入 Token 的 .env 路径（默认 $QIANLIMA_WORKDIR/.env）",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/qianlima_client.py:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05candidates.append(Path(workdir).expanduser() / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/qianlima_client.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05candidates.append(Path.cwd() / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Place credentials only in $QIANLIMA_WORKDIR/.env mode 600 (never into the skill folder)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandscripts/qianlima_client.py:754 · File permission modification command — agent changes file ownership/permissions
AST05f"[警告] {token_file} 权限过宽，建议执行 chmod 600",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathsscripts/qianlima_client.py:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05candidates.append(Path(__file__).resolve().with_name(".env"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/qianlima_qr_login.py:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05prefix=".env.", dir=path.parent, text=TrueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedscripts/qianlima_client.py:535 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/bootstrap_workdir.sh:9 · File permission modification command — agent changes file ownership/permissions
AST05chmod 700 "$WORKDIR" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathsscripts/qianlima_client.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Load .env from explicit path, workdir, CWD, or next to this script."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/bootstrap_workdir.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo "Create $WORKDIR/.env (mode 600) with QIANLIMA_TOKEN and QIANLIMA_OPENID, or export them on the host."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈1,087 tok
1 file · 7 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.