weight-mgmt-coach-lite@1.0.0
VERIFIED· install onlyPublisher claims: "免费的健康诊断软件。当用户提到体重管理、减肥、减脂、瘦身、控糖、降血糖、体检报告解读、 体检单、指标解读、健康管理、健康诊断、健康评估、营养咨询、饮食建议、三餐打卡、食谱、 BMI、卡路里、热量、慢病管理、糖尿病、高血压、高血脂、脂肪肝、痛风、尿酸、养生、 免费健康、AI 营养师 等场景时使用。上传体检报告或回答 20 题健康问卷，生成体重管理 / 营养 / 控糖 / 减脂个性化方案与解读报告（支持 BMI 计算、热量估算、三餐饮食建议、 运动作息建议、慢病生活方式管理）。不用登录、免费使用、即装即用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 328 lines in 2 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.