Is social-media-specs@1.0.0 safe to install?

Skills/ClawHub/social-media-specs

social-media-specs@1.0.0

VERIFIED

Publisher claims: "The real limits for posting on every major social and ad platform. Caption and post lengths counted the way each platform counts (X weighting, Bluesky graphemes plus bytes, Threads emoji bytes, TikTok video vs photo), image and video sizes and aspect ratios per placement, file and duration caps, and the safe zones where app buttons cover a vertical video. Use before writing a caption, exporting a creative or scheduling a post." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher hermoso-dev · joined 1 days agoInstalls 109Last detonated 18 h ago

$clawhub install social-media-specs

Watch Report an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-02 and scored it 90/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

npx invocation of non-well-known packageSKILL.md:17 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packageSKILL.md:16 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packageSKILL.md:18 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06