vectcut@1.5.11
CAUTION· static onlyPublisher claims: "VectCut 全能剪辑聚合技能。用于剪口播、混剪、电商广告等场景，统一编排流光剪辑能力（字幕、音频、特效、画中画、抠像、AI补镜、AI配音、预设、平台视频抓取、渲染导出），也支持把既有视频制作流程整理为飞书多维表格自动化工作流。当用户提出“做成片/自动剪辑/口播包装/广告剪辑/抓平台视频后再剪”，或想把视频制作..." Observed in sandbox: static analysis only — behavior not yet observed.
Registry ClawHubPublisher sun-guannan · publishing for 174 daysInstalls 2,897Last detonated 30 min ago
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-14 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyt+CategoryObserved action
This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
MEDIUM
URL with suspicious TLDreferences/effect_audios.json:3 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E6%89%93%E5%93%8D%E6%8C%87%E5%A3%B0.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Dense URL-encoded contentreferences/bgms.json:13 · Dense URL-encoded content — may be obfuscating payloads
AST07"https://player.install-ai-guider.top/koubo/bgm/%E5%BF%99%E7%A2%8C%E7%9A%84%E7%94%9F%E6%B4%BB%E4%BA%BA%E5%B1%B1%E4%BA%BA%E6%B5%B7.MP3",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contentreferences/effect_audios.json:3 · Dense URL-encoded content — may be obfuscating payloads
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E6%89%93%E5%93%8D%E6%8C%87%E5%A3%B0.MP3",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL with suspicious TLDreferences/bgms.json:3 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/bgm/void.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/effect_audios.json:4 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%98%9F%E5%92%9A%E6%8F%90%E7%A4%BA%E9%9F%B3.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/effect_audios.json:7 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%8D%81%E9%9D%A2%E5%9F%8B%E4%BC%8F%E5%97%AF.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/effect_audios.json:6 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%96%B7%E9%9B%BE%E5%89%82%E5%96%B7%E4%B8%80%E4%B8%8B.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/bgms.json:6 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/bgm/spoons_for_loons.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/bgms.json:4 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/bgm/time_to_pretend.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/effect_audios.json:5 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%9B%9E%E5%BF%86%E5%88%B7%E4%B8%80%E4%B8%8B.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/bgms.json:5 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/bgm/the_right_path.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with suspicious TLDreferences/bgms.json:7 · URL with suspicious TLD — commonly used for phishing/malware
AST07"https://player.install-ai-guider.top/koubo/bgm/night_cruising.MP3",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Dense URL-encoded contentreferences/bgms.json:14 · Dense URL-encoded content — may be obfuscating payloads
AST07"https://player.install-ai-guider.top/koubo/bgm/%E8%9D%B4%E8%9D%B6%E6%AD%A5.MP3"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedscripts/draft_downloader.py:63 · Python subprocess execution detected
AST05subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Dense URL-encoded contentreferences/effect_audios.json:6 · Dense URL-encoded content — may be obfuscating payloads
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%96%B7%E9%9B%BE%E5%89%82%E5%96%B7%E4%B8%80%E4%B8%8B.MP3",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contentreferences/effect_audios.json:5 · Dense URL-encoded content — may be obfuscating payloads
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%9B%9E%E5%BF%86%E5%88%B7%E4%B8%80%E4%B8%8B.MP3",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contentreferences/effect_audios.json:7 · Dense URL-encoded content — may be obfuscating payloads
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%8D%81%E9%9D%A2%E5%9F%8B%E4%BC%8F%E5%97%AF.MP3",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contentreferences/effect_audios.json:4 · Dense URL-encoded content — may be obfuscating payloads
AST07"https://player.install-ai-guider.top/koubo/yingxiao/%E5%98%9F%E5%92%9A%E6%8F%90%E7%A4%BA%E9%9F%B3.MP3",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.Cost to the agent
Instructions loaded
≈1,341 tok
1 file · 69 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim sun-guannan: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- URL with suspicious TLD≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- Dense URL-encoded content≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sun-guannanPropose a patch to the maintainer