occupation-analysis@1.1.1
VERIFIED· install onlyPublisher claims: "职业教育专业建设辅助工具，生成职业分析报告（工作过程系统化方法，七部分结构）。支持教育层次：中职、高职、职教本科。**MUST USE场景**：(1) 用户提供专业名称/代码，要求生成职业分析报告；(2) 用户明确要求"职业分析"、"工作任务分析"、"典型工作任务提取"；(3) 用户要求"行动领域划分"、"学习领域转换"、"学习情境设计"。**触发关键词**：职业分析、专业建设、典型工作任务、行动领域、学习领域、职业面向、教育层次、专业代码、课程开发、西餐烹饪、汽车维修。**输出物**：Markdown报告 + Word文档" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
| `scripts/generate_report.py` | Markdown 报告生成（表7/表8一致） | `python scripts/generate_report.py --data analysis.json --output report.md` |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.python scripts/generate_report.py --data temp/analysis_data.json --output temp/report.mdFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.| `scripts/integrate_data.py` | 多源数据整合 | `python scripts/integrate_data.py --major major.json --occupation occupation.json --mapping mapping.json --output combined.md` |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.python scripts/fetch_local.py --mapping temp/occupation_mapping_info.json --output temp/international_data.jsonFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.python scripts/generate_report.py --data temp/analysis_data.json --output temp/report.mdFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.- sudo apt-get update && sudo apt-get install -y pandocFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.