Skills/ClawHub/shadiao-manju

shadiao-manju@1.0.2

VERIFIED

Publisher claims: "沙雕漫剧（搞笑短动画）全流程 skill，跑在本地开源的「沙雕动画小助手」Web 社区版上。 把一句话 / 小说 / 热点，做成 1–2 分钟的沙雕竖屏动画：先写「音频优先」的沙雕剧本， 再用 edge-tts / IndexTTS 出配音，用 AI 生图出火柴人+熊猫头素材，最后程序化生成 可播放的 .anime 工程，在 app 里预览导出成片。 核心机制：音频时长驱动字幕与动作；剧本、配音、素材、工程四份产物靠同一项目目录交接。 触发词：沙雕漫剧、沙雕动画、沙雕短剧、搞笑动画、整活动画、做沙雕、沙雕小助手、 沙雕动画小助手、FunnyAnimationAssitant、.anime、火柴人动画、熊猫头动画、沙雕剧本、 沙雕配音、沙雕出片。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher kongzichixiangjiao · joined 0 days agoInstalls 26Last detonated 2 h ago
$clawhub install shadiao-manju
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 81/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file paths03-素材/shadiao-asset-skill/SKILL.md:216 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths03-素材/shadiao-asset-skill/scripts/gen_seedream.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths03-素材/shadiao-asset-skill/scripts/gen_seedream.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths00-工作台/setup_app.sh:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths03-素材/shadiao-asset-skill/SKILL.md:213 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:286 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths00-工作台/setup_app.sh:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths00-工作台/setup_app.sh:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths03-素材/shadiao-asset-skill/scripts/gen_seedream.py:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths03-素材/shadiao-asset-skill/scripts/gen_seedream.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detected02-配音/shadiao-voice-skill/scripts/tts_batch.py:158 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected02-配音/shadiao-voice-skill/scripts/tts_batch.py:175 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill command99-项目/示例-周一打工人/render_ep.sh:98 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detected05-出片/shadiao-export-skill/scripts/mix_audio.py:69 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected05-出片/shadiao-export-skill/scripts/add_endcard.py:28 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected05-出片/shadiao-export-skill/scripts/burn_subtitles.py:101 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected02-配音/shadiao-voice-skill/scripts/tts_batch.py:169 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected02-配音/shadiao-voice-skill/scripts/tts_batch.py:349 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected05-出片/shadiao-export-skill/scripts/add_endcard.py:36 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected02-配音/shadiao-voice-skill/scripts/tts_batch.py:186 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈8,576 tok
7 files · 82 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

shadiao-manju@1.0.2 safety verdict: Verified 81/100 — KillerSkills