Is skill-forge@2.2.0 safe to install?

skill-forge@2.2.0

CAUTION· install only

Publisher claims: "每天在网页上重复点的活：录制一遍，以后一条命令自动跑完，还能封装成可安装的技能。自动探网页接口，能走接口的转纯后台更稳更快。适合运营、投放、数据搬运。触发词：重复操作自动化、录制网页操作、浏览器自动化、网页脚本。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yysws5566 · publishing for 84 daysInstalls 0Last detonated 5 h ago

What would fix this Watch Dispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Hidden zero-width characters detected; Hidden zero-width characters detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

MEDIUM

File type combined with upload actionscripts/lib-farm.mjs:7 · File type combined with upload action — agent may exfiltrate local data files* v0.1.22 起认 locs 并能逐级自愈），生成的农场脚本.json 交 POST /script/new 即用。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiontest/草稿/映射核对表.html:7 · File type combined with upload action — agent may exfiltrate local data files

…" checked>是 <input type="radio" name="m2" value="否">否</td><td>消耗,展示次数</td><td>源表.csv</td><td>投放日报-共享表 [docs.qq.com]</td><td>CPM</td><td>公式</td><td>(消耗 ÷ 展示次数) × 100</td><td>≥95%行成立</td><td><input name="note2" size="24"></td></tr></table> <…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiontest/草稿/映射核对表.html:5 · File type combined with upload action — agent may exfiltrate local data files

…ue="是" checked>是 <input type="radio" name="m0" value="否">否</td><td>名称</td><td>源表.csv</td><td>投放日报-共享表 [docs.qq.com]</td><td>品牌</td><td>分列</td><td>按"-"分列取第1段</td><td>4/4行</td><td><input name="note0" size="24"></td></tr> <tr><td><input type=…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Python subprocess execution detectedscripts/pack_check.py:81 · Python subprocess execution detectedr = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathsSKILL.md:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

4. 🟡 **登录密码** → 泄露风险 → 只在内存里用一次，不落盘、不进日志、不进子包。**不要把账密写进环境变量、`.env`、脚本参数或配置文件**——那三类都会留痕；要无人值守就用 `SF_USER`/`SF_PASS` 当次会话传入（用完关终端），别写进任何文件。

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiontest/草稿/映射核对表.html:6 · File type combined with upload action — agent may exfiltrate local data files

…ue="是" checked>是 <input type="radio" name="m1" value="否">否</td><td>消耗</td><td>源表.csv</td><td>投放日报-共享表 [docs.qq.com]</td><td>花费(元)</td><td>数值/文本逐行命中</td><td></td><td>100%</td><td><input name="note1" size="24"></td></tr> <tr><td><input type=…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionscripts/build_skill.mjs:223 · File type combined with upload action — agent may exfiltrate local data files

if (farm.ok) console.log(`  农场：农场脚本.json 已出（${farm.script.steps.length} 步）——交 POST /script/new 挂机跑`);

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Hidden zero-width characters detectedscripts/manage.mjs:25 · Hidden zero-width characters detected — may conceal contentreturn fs.readFileSync(LEDGER, 'utf8').replace(/^/, '').split(/\r?\n/).filter(l => l.trim()).map(l => l.split(','));Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

MEDIUM

Python subprocess execution detectedtest/run_offline_test.py:52 · Python subprocess execution detectedr = subprocess.run([sys.executable, '-I', os.path.join(ROOT, 'scripts', 'analyze.py')] + list(args),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Access to sensitive file pathstest/run_forge_v2_test.mjs:313 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesok('凭证：写明禁止用环境变量/.env 存账密', md4.includes('不要把账密写进环境变量'));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionSKILL.md:279 · File type combined with upload action — agent may exfiltrate local data files

5. **触发.json 的「什么时候跑」由农场兑现**：UI 版 `build_skill` 对纯点击链路顺手产 `农场脚本.json`（多级定位直译成 farm 的 `locs`，farm v0.1.22 起认）——交农场 `POST /script/new` 就变成挂机脚本，登录态/自动开页/重连全归农场管。链路里有填值/粘贴步就不出（农场只会点，半截脚本会点错），打日志说明。

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Hidden zero-width characters detectedscripts/run.mjs:42 · Hidden zero-width characters detected — may conceal contentconst lines = fs.readFileSync(file, 'utf8').replace(/^/, '').split(/\r?\n/).filter(l => l.trim() && !l.startsWith('#'));Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

Cost to the agent

Instructions loaded

≈4,962 tok

1 file · 79 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim yysws5566: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yysws5566 Propose a patch to the maintainer