Skills/ClawHub/one-novel-skill

one-novel-skill@1.0.0

CAUTION· static only

Publisher claims: "融合级中文小说创作。从零开书到长篇日更，四层反AI防护，12套L2检测，创作宪法/澄清决策/时间线校验，多视角对抗式审查。你说'帮我写个小说'，剩下的我来做。零配置自适应LLM，支持Ollama任意模型/OpenClaw/DeepSeek/OpenAI/Claude/Gemini/通义千问/智谱/月之暗面/百川/自定义端点，安装即用。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher xincen0725 · publishing for 131 daysInstalls 567Last detonated 10 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-12 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Unicode escape sequence detectedengine/identity_provider.py:190 · Unicode escape sequence detected — may contain obfuscated payloads"pacing": "\u5feb\u8282\u594f\uff0c\u6bcf\u7ae0\u6709\u5c0f\u51b2\u7a81\uff0c\u5f00\u7bc7\u5373\u77db\u76fe",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/identity_provider.py:184 · Unicode escape sequence detected — may contain obfuscated payloads"reader": "\u91cd\u5ea6\u9605\u8bfb\u8005\uff0c\u5bf9\u8bbe\u5b9a\u4e25\u8c28\u6027\u8981\u6c42\u9ad8",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detecteddetectors/pipeline.py:103 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True, timeout=15)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedengine/context_builder.py:132 · Unicode escape sequence detected — may contain obfuscated payloadslines.append("\u3010\u524d\u60c5\u63d0\u8981\u3011")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/phase_gate.py:188 · Unicode escape sequence detected — may contain obfuscated payloads_log.info("PhaseGate: \u516d\u5927\u5e93\u5168\u90e8\u5c31\u7eea\uff0c\u53ef\u4ee5\u5f00\u59cb\u5199\u4f5c")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/identity_provider.py:182 · Unicode escape sequence detected — may contain obfuscated payloads"pacing": "\u4e2d\u6162\u901f\u85c4\u529b\uff0c\u9ad8\u6f6e\u91ca\u653e\u5145\u5206",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedengine/generator.py:206 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedengine/context_builder.py:114 · Unicode escape sequence detected — may contain obfuscated payloadslines.append("\u3010\u672a\u56de\u6536\u4f0f\u7b14\u3011")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/identity_provider.py:183 · Unicode escape sequence detected — may contain obfuscated payloads"opening": "\u524d50\u7ae0\u5efa\u7acb\u5b8c\u6574\u529b\u91cf\u4f53\u7cfb\u548c\u4e3b\u7ebf\u76ee\u6807\uff0c\u53ef\u94fa\u57ab\u8f83\u957f",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedengine/generator.py:458 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detecteddetectors/pipeline.py:66 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedengine/context_builder.py:102 · Unicode escape sequence detected — may contain obfuscated payloadslines.append("\u3010\u89d2\u8272\u72b6\u6001\u3011")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/context_builder.py:145 · Unicode escape sequence detected — may contain obfuscated payloadslines.append("\u3010\u76f8\u5173\u89d2\u8272\u3011")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/phase_gate.py:214 · Unicode escape sequence detected — may contain obfuscated payloadsstatus.messages.append("ResearchEngine: \u26a0\ufe0f \u7814\u7a76\u5f15\u64ce\u672a\u914d\u7f6e\u5b8c\u5584")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedengine/generator.py:144 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedengine/generator.py:433 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedengine/phase_gate.py:212 · Unicode escape sequence detected — may contain obfuscated payloadsstatus.messages.append("ResearchEngine: \u2705 \u7814\u7a76\u5f15\u64ce\u5c31\u7eea")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/context_builder.py:151 · Unicode escape sequence detected — may contain obfuscated payloadslines.append("\u3010\u6d3b\u8dc3\u4f0f\u7b14\u3011")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/phase_gate.py:182 · Unicode escape sequence detected — may contain obfuscated payloads_log.warning(f"PhaseGate: \u7981\u6b62\u5f00\u59cb\u2014\u2014\u516d\u5927\u5e93\u672a\u5168\u90e8\u5c31\u7eea")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/identity_provider.py:185 · Unicode escape sequence detected — may contain obfuscated payloads"taboo": "\u8fc7\u5ea6\u73a9\u689f/\u6c99\u96d5\u98ce\u3001\u903b\u8f91\u5d29\u574f",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/pipeline.py:358 · Unicode escape sequence detected — may contain obfuscated payloads# --- Phase C3b-ii: WorldEngine — 世\u754c\u89c2\u89c4\u5219\u6821\u9a8c ---Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/writing_notes.py:20 · Unicode escape sequence detected — may contain obfuscated payloads"paragraph": "\u6bb5\u843d\u63a7\u5236\u57281-3\u53e5\uff0c\u5bf9\u8bdd\u5360\u6bd430-50%",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/pipeline.py:356 · Unicode escape sequence detected — may contain obfuscated payloads_log.warning(f"Pipeline: ch{ch} \u5168\u5c40\u8bb0\u5fc6\u5f15\u64ce\u5931\u8d25: {_gme}")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/writing_notes.py:18 · Unicode escape sequence detected — may contain obfuscated payloads"opening": "\u524d300\u5b57\u5fc5\u987b\u5b8c\u6210\uff1a\u4ecb\u7ecd\u4e3b\u89d2 + \u7ed9\u91d1\u624b\u6307/\u7cfb\u7edf + \u7b2c\u4e00\u4e2a\u51b2\u7a81",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/phase_gate.py:226 · Unicode escape sequence detected — may contain obfuscated payloadsstatus.messages.append(f"ReferenceEngine: \u2705 \u53c2\u8003\u6587\u6863\u5c31\u7eea ({len(ref_files)}\u4e2a)")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/writing_notes.py:19 · Unicode escape sequence detected — may contain obfuscated payloads"pacing": "\u6781\u5feb\u8282\u594f\uff0c\u6bcf\u7ae0\u81f3\u5c111\u6b21\u60c5\u7eea\u6ce2\u52a8",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/pipeline.py:371 · Unicode escape sequence detected — may contain obfuscated payloads_log.debug("Pipeline: ch{} \u4e16\u754c\u89c2\u5f15\u64ce\u5931\u8d25: {}".format(ch, _we_e))Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedengine/writing_notes.py:21 · Unicode escape sequence detected — may contain obfuscated payloads"ending": "\u7ae0\u672b\u5fc5\u987b\u65ad\u5728\'\u63a5\u4e0b\u6765\u4f1a\u600e\u6837\'\u7684\u60ac\u5ff5\u4e0a",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈2,551 tok
1 file · 285 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim xincen0725: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  3. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim xincen0725Propose a patch to the maintainer