oia-skill@1.1.1
VERIFIED· install onlyPublisher claims: "使用 oia 框架（npm 包 @oia-ai/oia-fresh）初始化全栈项目。当用户要求「创建 oia 项目」「初始化 oia / oia-fresh」「用 oia 框架搭一个应用」时触发。 译文：Init project with OIA (@oia-ai/oia-fresh). Trigger on "create OIA project", "init oia-fresh", "build with OIA". Includes env check, npx init, dev server & verify." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
description: 使用 oia 框架（npm 包 @oia-ai/oia-fresh）初始化 Deno + Fresh Web 项目。当用户要求「创建 oia 项目」「初始化 oia / oia-fresh」「用 oia 框架搭一个应用」时触发。完成 Deno 环境检查、npx @oia-ai/oia-fresh init 脚手架、启动开发服务器并验证的完整流程。Fix: Pin versions and sources; vendor anything fetched at install time.* 用法：npx @oia-ai/oia-skill 安装到当前项目 .claude/skills/oia-skillFix: Pin versions and sources; vendor anything fetched at install time.- macOS / Linux：`curl -fsSL https://deno.land/install.sh | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.npx -y @oia-ai/oia-skill --global # 安装到用户目录（所有项目可用）Fix: Pin versions and sources; vendor anything fetched at install time.oia 框架以 `@oia-ai/oia-fresh` 为名发布在 npm 仓库，初始化命令为 `npx @oia-ai/oia-fresh init`。Fix: Pin versions and sources; vendor anything fetched at install time.npx -y @oia-ai/oia-skill # 安装到当前项目Fix: Pin versions and sources; vendor anything fetched at install time."description": "oia 框架的 Claude Code skill：基于 @oia-ai/oia-fresh 初始化 Deno + Fresh Web 项目，npx @oia-ai/oia-skill 一键安装到 .claude/skills",Fix: Pin versions and sources; vendor anything fetched at install time.* npx @oia-ai/oia-skill --global 安装到用户目录 ~/.claude/skills/oia-skillFix: Pin versions and sources; vendor anything fetched at install time.- `npx --version`：确认 Node / npx 可用（仅用于执行 init 脚本，项目运行不依赖 Node）。Fix: Pin versions and sources; vendor anything fetched at install time.- macOS / Linux：`curl -fsSL https://deno.land/install.sh | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.