Skills/ClawHub/ssq-skill

ssq-skill@1.0.0

CAUTION· static only

Publisher claims: "双色球算法选号防被骗 · 理性购彩科普助手 + 防割韭菜盾：随机性检验、选号思路科普与打假、胆拖结构优化、开奖数据核对，只讲真话、帮你买得明白不被大师割韭菜。当用户想了解双色球开奖的随机性、鉴别选号套路、核对开奖数据、或做理性购彩科普时使用。生成严谨的科普分析报告，内置对"预测可行性"的统计证伪（红球熵效率/任一组合恒等概率/样本外回测/no_edge 结论）、22 项自检护栏。核心立场：数学上任何选号思路都不优于随机，仅供娱乐参考，须量力而行、绝不可作为收益依据。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher hmily741963 · publishing for 82 daysInstalls 404Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-08 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Python subprocess execution detectedssq_auto.py:3337 · Python subprocess execution detected_enh = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedssq_auto.py:1646 · Unicode escape sequence detected — may contain obfuscated payloads'<div class="bm-balls" id="bmBalls1"><span class="bm-h">\u70B9\u6309\u94AE\u6447\u51FA\u7075\u611F\u53F7</span></div>'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedssq_auto.py:1643 · Unicode escape sequence detected — may contain obfuscated payloads…v class="ttl">\u9009\u53F7\u6709\u4F9D\u636E</div>' '<div class="desc">5 \u7EC4\u7B56\u7565\u7EC4\u5408\uff0c\u5168\u90E8\u8FC7 9 \u9879\u8FC7\u6EE4\u5668\uff0c\u6BCF\u6CE8\u90FD\u6807\u6CE8\u201C\u5A31\u4E5…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedssq_auto.py:1647 · Unicode escape sequence detected — may contain obfuscated payloads'<button class="bm-btn" onclick="bmRoll()">\u2728 \u6447\u4E00\u6CE8\u7075\u611F\u53F7</button>'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedrun_ssq.py:66 · Python subprocess execution detectedrc = subprocess.run(cmd, cwd=LIB_DIR).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_auto.py:1413 · Python subprocess execution detectedsubprocess.Popen([py, script],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_smart.py:541 · Python subprocess execution detectedr = subprocess.run([PYTHON, "ssq_healthcheck_all.py"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrun_ssq.py:131 · Python subprocess execution detectedsubprocess.run([PY, os.path.join(LIB_DIR, "ssq_enhance.py")], cwd=LIB_DIR,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_healthcheck_all.py:929 · Python subprocess execution detectedr = subprocess.run(["schtasks", "/query", "/tn", task_name, "/xml", "ONE"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_healthcheck_all.py:269 · Python subprocess execution detectedreturn subprocess.run([PYTHON, script], cwd=WORK_DIR,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedssq_fun_pack.py:207 · Unicode escape sequence detected — may contain obfuscated payloads' <input class="fp-input" id="catName" placeholder="\u7ED9\u62DB\u8D22\u732B\u8D77\u4E2A\u540D\u5B57" maxlength="8" />'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedssq_ledger.py:118 · Unicode escape sequence detected — may contain obfuscated payloads'\u62FF\u6E05\u771F\u5B9E\u4E8F\u6321\u4F4F\u52A0\u6CE8\u7684\u6192\u3002</p>'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL with suspicious TLDssq_huiniao_api.py:24 · URL with suspicious TLD — commonly used for phishing/malwareurl = f"http://api.huiniao.top/interface/home/lotteryHistory?type=ssq&page={page}&limit={limit}"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedssq_healthcheck_all.py:312 · Python subprocess execution detectedr = subprocess.run([PYTHON, "-m", "py_compile", fp],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedssq_ledger.py:117 · Unicode escape sequence detected — may contain obfuscated payloads'<p class="tip">\u53EA\u8BB0\u5DF2\u53D1\u751F\u7684\u4EA4\u6613\uFF0C\u4E0D\u9884\u6D4B\u3001\u4E0D\u627F\u8BFA\u3002'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedssq_fun_pack.py:145 · Unicode escape sequence detected — may contain obfuscated payloads…t" id="fpCat">' ' <div class="cat-bubble" id="catBubble">\u4E3B\u4EBA~\u6211\u662F\u62DB\u8D22\u732B\uff0c\u70B9\u6211\u783B\u783B\u3001\u5582\u5582\u6211\u3001\u6362\u88C5\u90FD\u884C\uFF0C\u8D8A\u73A9\u8D8A\u4EB2\u5BC6\u54DF\U0001F49E</d…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL with suspicious TLDssq_huiniao_api.py:61 · URL with suspicious TLD — commonly used for phishing/malwareurl = "http://api.huiniao.top/interface/home/lotteryHistory?type=ssq&page=1&limit=100"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDssq_huiniao_api.py:5 · URL with suspicious TLD — commonly used for phishing/malwareAPI: http://api.huiniao.top/interface/home/lotteryHistory?type=ssq&page=1&limit=100Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Unicode escape sequence detectedssq_ledger.py:128 · Unicode escape sequence detected — may contain obfuscated payloads'\u671F\u671B\u4E3A\u8D1F\u662F\u6570\u5B66\u5FC5\u7136\uff0c\u628A\u8D2D\u5F69\u5F53\u5C0F\u989D\u5A31\u4E50\u3002'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedssq_healthcheck_all.py:828 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedssq_ledger.py:127 · Unicode escape sequence detected — may contain obfuscated payloads'<p class="tip">\u53CD\u9988\u7387\u7406\u8BBA\u7EBF\u2248' + str(int(RETURN_RATE*100)) + '%\uff1b'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedssq_auto.py:1648 · Unicode escape sequence detected — may contain obfuscated payloads'<div class="bm-note">\u7EAF\u5A31\u4E50 \u00B7 \u975E\u771F\u5B9E\u9009\u53F7\u4F9D\u636E</div>'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedssq_healthcheck_all.py:232 · Python subprocess execution detected_prelaunch[script] = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedssq_ledger.py:116 · Unicode escape sequence detected — may contain obfuscated payloads'<h3>\U0001F4D3 \u8BDA\u5B9E\u8D26\u672C \u00B7 \u4F60\u7684\u53CC\u8272\u7403\u771F\u5B9E\u76C8\u4E8F</h3>'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedssq_fun_pack.py:225 · Unicode escape sequence detected — may contain obfuscated payloads' <h3>\U0001F388 A \u00B7 \u751F\u65E5/\u7EAA\u5FF5\u65E5\u9009\u53F7\u5668</h3>'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedssq_fun_pack.py:226 · Unicode escape sequence detected — may contain obfuscated payloads…51F\u65E5/\u7EAA\u5FF5\u65E5\u9009\u53F7\u5668</h3>' ' <p class="tip">\u9009\u4E2A\u5BF9\u4F60\u6709\u610F\u4E49\u7684\u65E5\u5B50\uFF0C\u751F\u6210\u4E00\u7EC4"\u6709\u6545\u4E8B"\u7684\u53F7\u7801\uFF08\u7EAF\u5A31\u4E50\u53C2\u8003\uFF0…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedssq_watchdog_win.py:109 · Python subprocess execution detectedrx = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_smart.py:580 · Python subprocess execution detectedr = subprocess.run([PYTHON, "ssq_expert_tracker.py"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injectionREADME.md:274 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file- **验证**：相邻目标期胆拖 dan/back 候选明显不同（26086→`[26,29,15]+[19,4,14,10]` 后`[2,6,9,11]`；26087/88/89 候选各异）；报告胆拖卡现显示"蓝球 4 码"+`C(4,2)=6` 组。Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedssq_smoke_test.py:106 · Python subprocess execution detectedr = subprocess.run([PY, gate], cwd=ROOT,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_smart.py:279 · Python subprocess execution detectedsubprocess.run([PYTHON, "ssq_enhance.py"], cwd=WORK_DIR,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_watchdog_win.py:76 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_smart.py:127 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_watchdog_win.py:196 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedssq_smart.py:561 · Python subprocess execution detectedr = subprocess.run([PYTHON, "ssq_expert_scraper.py", "--auto"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈4,698 tok
1 file · 61 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim hmily741963: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. URL with suspicious TLD≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim hmily741963Propose a patch to the maintainer