Skills/ClawHub/project-settlement-pack-free

project-settlement-pack-free@1.0.26

VERIFIED

Publisher claims: "把工程与项目结算材料按 14 项检查（工程产值与进度确认、工程进度款与质保金核算、工程质量保证金扣留与退还、项目开票与回款、项目挣值分析（EVM）、在建工程转固与利息资本化、在建工程转固、维修资金与专项工程付款、分包结算与产值、预付款与预付账款核销、罚款与违约金结算、安全生产费用提取与使用、投标保证金收退、软件外包里程碑验收与付款）逐项目核一遍，每个项目一行结论，结论都带原文文件与行号。完全本地运行，核对过程不需要联网、不需要 API Key、没有次数上限。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher chenqg618 · joined 7 days agoInstalls 417Last detonated 1 h ago
$clawhub install project-settlement-pack-free
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionSKILL.md:81 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

No other findings across 6,746 lines in 19 files.

Cost to the agent

Instructions loaded
≈1,022 tok
1 file · 19 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.