Skills/ClawHub/sk-1a6602177e7e

sk-1a6602177e7e@1.0.0

VERIFIED

Publisher claims: "大学里那些不好意思问朋友、也不想跟家里说的事，都能扔给我——室友太吵、挂科了咋办、生活费不够花、兼职是不是坑、心里堵得慌。我会按你的当下状态给你实在话，不灌鸡汤，也不替你下结论。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dora233 · joined 0 days agoInstalls 284Last detonated 2 h ago
$clawhub install sk-1a6602177e7e
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 89/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Hidden zero-width characters detecteddata/memes.json:143 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07

No other findings across 3,410 lines in 19 files.

Cost to the agent

Instructions loaded
≈1,221 tok
1 file · 19 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.