wear-everything@1.0.25

CAUTION

Publisher claims: "鞋包配饰真人穿戴图。商品图 + 模特参考图 → 真人佩戴图，落位、透视与阴影自然。当用户说「鞋包上脚」「配饰上身」「墨镜戴上」「首饰佩戴图」「包包上身」时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dlazyai · joined 2 days agoInstalls 1,680Last detonated 31 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Fake instruction boundary tagreferences/provider-cli.md:130 · Fake instruction boundary tag

AST01

HIGH

npx invocation of non-well-known packagescripts/brand.mjs:97 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsscripts/lib/providers.mjs:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Fake instruction boundary tagreferences/model-flags.md:13 · Fake instruction boundary tag

AST01

HIGH

npx invocation of non-well-known packagereferences/provider-cli.md:68 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsscripts/gen.mjs:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05