Skills/ClawHub/procurement-payable-pack-free

procurement-payable-pack-free@1.0.24

VERIFIED

Publisher claims: "把采购与付款底稿按 14 项检查（供应商应付对账、应付账款账龄与付款计划核对、应付暂估与发票未到核对、应付账款保理与贴现核对、采购返利与阶梯核算核对、投标保证金收退核对、履约保证金与保函台账核对、中标结果与合同一致性核对、合同一致性AI核对、多份合同条款差异比对、三单匹配AI核对、报销单合规预检、预付卡消费核销核对、预收账款与收入确认核对）逐个对象核一遍，每个对象一行结论，结论都带原文文件与行号。完全本地运行，核对过程不需要联网、不需要 API Key、没有次数上限。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher chenqg618 · joined 7 days agoInstalls 407Last detonated 1 h ago
$clawhub install procurement-payable-pack-free
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionSKILL.md:82 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

No other findings across 6,953 lines in 19 files.

Cost to the agent

Instructions loaded
≈1,034 tok
1 file · 19 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.