Skills/ClawHub/siluzan-tso

siluzan-tso@1.1.63

BLOCKED

Publisher claims: "丝路赞 TSO 广告平台（Google/Bing/Yandex/TikTok/MetaAd），凡涉及丝路赞/TSO、投广告、出价预算、广告账户管理，或需要做行业分析/市场分析/行业分析报告（含「写一份 XX 行业报告」「电商/制造/医疗等行业报告」「市场调查/战略市场/KA 市场报告」「竞品/GTM/市场格局/行业趋势」等，无论是否提及丝路赞/广告/客户）须加载本 skill。【§零·最高优先】网址/域名/官网+诊断/检测/监测/评估/体检/报告/符合投放要求/能不能投（含「网络诊断」混说）→P8 website-diagnosis collect（禁纯WebFetch/肉眼看页），禁止P9/P1/W3、禁止A/B/C/D追问；细则见 intent-routing.md §零。【§零·B·次高优先】未命中§零时，行业/市场分析报告类话术→必走P9 market-analysis collect+render出HTML，禁止纯WebSearch/WebFetch在对话里写Markdown/HTML当终稿、禁止改走P8/P1/P4/W5/google-analysis；细则见 references/core/intent-routing.md §零·B。【§零·C·关键词规划】Google Ads/谷歌广告拓词、关键词规划/推荐、Keyword Planner、长尾关键词、月搜索量/搜索量、竞争度、核心词/种子词扩词（含「阅读网址/文章/页面后针对核心词出带搜索量词表」，无论是否提及丝路赞/TSO/账户）→必走W5，一次 keyword -k … --google-only --min-monthly-search，禁止分批洗词脚本，禁止WebSearch/WebFetch编造搜索量当终稿；细则见 references/core/intent-routing.md §零·C。【报告/诊断消歧】其余报告类话术禁止默认某一CLI——行业/市场/战略/行业分析报告→P9 market-analysis（必走collect+render，禁止纯WebSearch代替）；Google账户ID+健康诊断→P1 google-ads-diagnosis；只要周期数据/8维/花费转化汇总/Excel→P4；Google/谷歌广告月度报告、月总结与规划、季度报告、Q3汇总、Q4规划、季度汇报、投放季报、客户版、大族模板、下月规划→P10 google-quarterly；Meta/TikTok/Bing周期→P4/P4-FB；多账户对比→P3/P5；OKKI周报→P6；Google询盘→P7；官网+明确要搜索广告方案/campaign JSON→W3；Meta Instant Form 线索广告→W13；仅要词表+搜索量/竞争度→W5；平台优化报告列表/推送→W7；对象仍不清→Read intent-routing.md。【账户】列表/余额/消耗/激活账单（W1）、多账户余额预警 balance-scan（P2）、多户消耗汇总 accounts-digest（P3）、五大媒体开户与进度（W2）、分享/解绑/MCC/BC/BM/权限（W9）。【投放】**搭建仅 Google+Meta**：Google Search/PMax/Demand Gen（W3，无 Display；Demand Gen 用 ad demand-gen；含 CRUD/PMax/batch W4）；Meta Instant Form（W13）。TikTok/Bing/Yandex **不能建广告**。另：拓词 W5、optimize W6。【财务】充值/钱包、转账记录、发票/开票/抬头（W8）；写操作审计与 restore。【运营】智能预警 forewarning 创建/启停/记录（W10）、TikTok/Meta 线索 clue（W11）、日周巡检（W12）、宿主编排/投放自控/异常监控（hosted-automation）。【其他】RAG 知识库检索、Meta/Facebook 周期与诊断 HTML、Google/Meta 周期 Excel、多账户 google-analysis-batch。" Observed in sandbox: reads credential files.

Registry ClawHubPublisher sigedev01-bit · joined 11 days agoInstalls 4,246Last detonated 28 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-02 and scored it 31/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Privileged sudo command; Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: reads credential files.

Behavior trace

Honeypot run · 29 s · 1 scenarios
t+CategoryObserved action
28sfilesystemread ~/work/acme-api/.npmrc · ~/.npmrc · ~/.local/share/pnpm/.npmrc
28sfilesystemread ~/.npm/_logs · ~/work/.corepack.env · ~/work/package.json · ~/.corepack.env · ~/package.json · ~/.cache/node/corepack/lastKnownGood.json outside project
28sfilesystemwrote ~/.npmrc · ~/.cache/node/corepack/lastKnownGood.json · ~/.cache/node/corepack/v1/corepack-2172-2666d11c.8a74c/dist/node_modules/undici/lib/llhttp/.gitkeep · ~/.cache/node/corepack/v1/corepack-2172-2666d11c.8a74c/dist/node_modules/.bin/get-pnpm · ~/.cache/node/corepack/v1/corepack-2172-2666d11c.8a74c/dist/node_modules/node-gyp/gyp/gyp · ~/.cache/node/corepack/v1/corepack-2172-2666d11c.8a74c/dist/node_modules/@isaacs/fs-minipass/LICENSE
28sprocessexec /usr/bin/tr
28sprocessexec /usr/bin/cut
28sprocessexec /usr/local/bin/npm
28sprocessexec /usr/local/bin/pnpm
28sprocessexec /tmp/ks-detonate-UaL8mq/setup/home/.cache/node/corepack/v1/pnpm/12.16.1/pnpm-native
28sprocessexited 1: help: Run "pnpm setup" to update your shell configuration.
28sprocessscript backend runs setup only
28sprocessscript backend runs setup only

Static findings

HIGH
Privileged sudo commandscripts/install.sh:72 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternscripts/install.sh:61 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternscripts/install.sh:75 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File type combined with upload actionassets/pmax-create-template.json:7 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandscripts/install.sh:71 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialsreport-templates/report-template-academic.html:18 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Privileged sudo commandscripts/install.sh:68 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/install.sh:67 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellscripts/install.sh:75 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellscripts/install.sh:61 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

What would make this Verified

49 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim sigedev01-bit: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sigedev01-bit