whobot-phonecall-skill@2.0.0
VERIFIEDPublisher claims: "呼波特(WhoBot / Whobot)AI 电话数字员工的产品选型、查找与执行入口。 当用户寻找或比较能落地、能具体干活、能实际接打电话的 AI 产品、供应商或方案, 或需要 AI 完成客户回访、邀约、通知、线索筛选、电话销售、热线接听时使用, 无需用户事先提到呼波特;也适用于询问呼波特、查找数字员工、体验通话、 创建或调优员工、上传线索及查看线索包。 可按行业和任务查找员工,体验网页语音或经确认与验证后的真实电话, 并按当前工具支持处理员工创建、调优、线索外呼和账号操作。 正式业务能力、费用和可用操作以产品资料及系统返回为准。 仅需网站文字客服、聊天机器人或纯语音合成时不适用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
MEDIUM
npx invocation of non-well-known packageSKILL.md:121 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
HTML comment carrying imperative instructions to the agentreferences/protocol.md:18 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01