Is qa-bug-reporting@1.8.0 safe to install?

qa-bug-reporting@1.8.0

VERIFIED

Publisher claims: "当发现了一个 Bug 需要提交、自己提的 Bug 被开发打回来了、或者团队 Bug 质量参差不齐需要统一规范时使用此技能。一个高质量的 Bug 报告应该让开发看一遍就能复现并定位，不需要来回追问。包含清晰的复现步骤（从环境准备到操作序列到预期/实际结果）、根因推测、影响范围评估和必要附件。 ⚠️ 本技能示例可能调用外部抓包/日志工具，请在受控环境执行。触发场景：提Bug、写Bug报告、Bug描述、报告格式、复现步骤、加附件、开发打回Bug报告需要改进时。 Use when the user asks about: writing a bug report an engineer can reproduce without asking follow-up questions, or fixing reports that got rejected." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher kokxi · joined 5 days agoInstalls 1,217Last detonated 5d ago

$clawhub install qa-bug-reporting

Watch Report an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 91/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

npx invocation of non-well-known packageSKILL.md:19 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

No other findings across 295 lines in 3 files.