transcript-crafter@1.3.1
VERIFIED· install onlyPublisher claims: "访谈实录转公众号深度长文全流程：10维度提取→人设适配→框架→5工具搜索补充→重构撰写。Invoke when提取并转写、转写公众号长文、提取干货。Do NOT for原创写作、热点文章、纯翻译。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
| 文件读写 | ✅ | 读取用户提供的本地文件（.txt/.md/.docx）、写入最终文章到用户桌面、写入素材稿/补充信息到技能 output 目录 |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.No other findings across 3,165 lines in 12 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.