Skills/ClawHub/qinghu-1688-keyword-search

qinghu-1688-keyword-search@0.1.1

VERIFIED

Publisher claims: "青虎AI 1688-关键词找货：按关键词在 1688 搜索货源，可按销量、价格区间、48 小时揽收率等条件筛选并排序。当用户说「1688 上搜一下××的货源」「找××的厂家，按销量排序」「拿货价在 X 到 Y 元之间的××」或提出同类需求时必须触发。关键词：青虎AI、qhkit、青虎数据、1688、阿里巴巴、关键词找货、批发、货源筛选、拿货价、源头工厂、商品关键词搜索。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher autoagc · joined 7 days agoInstalls 315Last detonated 1 h ago
$clawhub install qinghu-1688-keyword-search
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-03 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:90 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencySKILL.md:109 · Unpinned dependencyFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06