Skills/ClawHub/reading-notes-master

reading-notes-master@2.9.1

VERIFIED

Publisher claims: "一图解千言的出版级可视化读书笔记生成器（Chart-First 图表驱动 v2.9）。 31 份语料双透镜实测（排版美学 + 视觉密度）；6 大叙事原型、9 大模块、10+6 类组件、 12 类文字→图表映射；v2.2 咨询级页面工艺、v2.3 图形资产管线、v2.4 设计智能前置检索、 v2.5 思维模型库+文生图、v2.6 NG 竖版杂志、v2.7 HBR 横版杂志、 v2.8 科研级图表体系（38 图型×11 大类/9 色板/9 期刊预设/四门验收/20 红线/figure-bridge 桥接）、 v2.9 全图型 4K 级输出（位图长边≥3840 且短边≥2160、矢量等效、DPI 自动反推+像素实测门禁）。 输入一本书的要点/金句/结构，输出图表主导、少文字、出版级排版笔记（HTML/PDF/PPTX/长图）。 触发词：读书笔记、生成笔记、可视化读书笔记、一图解千言、图表化笔记、读书分享、书摘卡片、 reading notes、读书笔记PPT、读书报告、精华笔记、营销笔记、情绪开关、咨询级笔记、论证型笔记、 图形复刻、复刻图表、位图转矢量、图片超分、思维导图导出、图表工具链、设计系统、品牌风格、 UI规范检索、思维模型、模型图型、马斯洛/金字塔/SWOT、飞轮/复利/二八/冰山/决策树、文生图、 竖版笔记、杂志风笔记、国家地理风格、NG风、横版杂志、HBR风、期刊复刻、年度精选、 科研图表、学术图表、SCI 配图、期刊合规、色盲安全、Okabe-Ito、森林图、KM 曲线、雨云图、 山脊图、哑铃图、复合多面板、PRISMA、误差棒、600dpi、4K 图表、4K 出图、投稿包、数据契约。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yjkj999999 · joined 13 days agoInstalls 440Last detonated 1 h ago
$clawhub install reading-notes-master
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-04 and scored it 80/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Pipe-to-shell patternreferences/design-intelligence/awesome-design/SKILL.md:110 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Python subprocess execution detectedscripts/figure-bridge.py:195 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellreferences/design-intelligence/awesome-design/SKILL.md:110 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedtemplates/hbr-magazine/build-template.py:77 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/figure-bridge.py:402 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/figure-bridge.py:440 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/figure-bridge.py:303 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/figure-bridge.py:391 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
reading-notes-master@2.9.1 safety verdict: Verified 80/100 — KillerSkills