rss-feed-digest-tool-free@1.0.1
VERIFIEDPublisher claims: "RSS聚合摘要免费版为个人用户提供轻量级的RSS/Atom订阅聚合与摘要生成能力。核心能力: - 多源RSS/Atom订阅抓取 - 关键词包含/排除过滤 - 跨源自动去重 - 时间范围筛选 - Markdown/纯文本输出 适用场景: - 个人每日资讯摘要生成 - 兴趣主题内容聚合 - 简单的订阅源监控 差异化:免费版聚焦核心聚合与过滤流程,通过Python脚本实现轻量部署,适合个人用户快速生成每日摘要,无需数据库或复杂配置" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-31 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
MEDIUM
File type combined with upload actionSKILL.md:310 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07HIGH
URL with embedded credentialsSKILL.md:326 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07