product-video-ad@1.0.22

CAUTION

Publisher claims: "商品短视频广告。卖点 → 分镜脚本 → 分段生成 → 拼接加字幕成片。当用户说「做条广告」「短视频」「投流素材」「分镜脚本」「带货视频」时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dlazyai · joined 2 days agoInstalls 1,500Last detonated 29 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packagereferences/provider-cli.md:68 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsscripts/gen.mjs:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsscripts/video.mjs:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagescripts/brand.mjs:97 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Fake instruction boundary tagreferences/provider-cli.md:130 · Fake instruction boundary tag

AST01

CRITICAL

Access to sensitive file pathsscripts/lib/providers.mjs:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05