tencent-news-sports-schedule@1.0.0
CAUTIONPublisher claims: "当用户查询某项体育赛事或某支球队的赛程、下一场比赛、比赛时间、对阵、比分、直播链接或支持的赛事列表时使用。通过腾讯新闻 CLI 查询已接入的中超、英超、西甲、欧冠、NBA、苏超等赛事；实际覆盖范围以当次赛事列表为准。不用于体育新闻、积分榜、球员统计或比赛集锦。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher tencent-adm · joined 1 days agoInstalls 65Last detonated 17 h ago
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
File permission modification commandscripts/run-cli.sh:149 · File permission modification command — agent changes file ownership/permissions
AST05HIGH
File permission modification commandscripts/cli-state.sh:94 · File permission modification command — agent changes file ownership/permissions
AST05MEDIUM
Remote installer piped to shellreferences/update-guide.md:20 · Remote installer piped to shell
AST07HIGH
File permission modification commandscripts/cli-state.sh:125 · File permission modification command — agent changes file ownership/permissions
AST05HIGH
File permission modification commandreferences/sport.md:108 · File permission modification command — agent changes file ownership/permissions
AST05MEDIUM
Remote installer piped to shellreferences/cli-environment.md:24 · Remote installer piped to shell
AST07CRITICAL
Pipe-to-shell patternreferences/cli-environment.md:24 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06CRITICAL
Pipe-to-shell patternreferences/update-guide.md:20 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06MEDIUM
Remote installer piped to shellreferences/installation-guide.md:8 · Remote installer piped to shell
AST07CRITICAL
Pipe-to-shell patternreferences/installation-guide.md:8 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06