Skills/ClawHub/x-subscribe

x-subscribe@1.0.1

VERIFIED

Publisher claims: "X(Twitter)订阅账号推文工具 — 订阅 Twitter 名人账号（来源：榜单推荐 / 用户指定 @handle / 关注列表探索），每日早上 9:00 自动拉取订阅账号昨日最新推文，按账号分组生成 HTML 日报推送，无需手动操作。支持最多 100 个账号批量订阅、按日期过滤翻页、互动数据（浏览/点赞/转发/回复）展示与 AI 总结。当用户需要订阅 Twitter/X 账号、追踪名人推文动态、监控 KOL 发声、获取 X 账号昨日发帖日报时使用。触发词：X订阅、Twitter订阅、订阅推特账号、订阅推文、X名人日报、Twitter账号追踪、关注列表探索、订阅KOL、推特动态订阅、X日报" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher redfox-data · joined 14 days agoInstalls 313Last detonated 1 h ago
$clawhub install x-subscribe
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-05 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Python subprocess execution detectedscripts/generate_report.py:476 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/subscribe.py:501 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/generate_report.py:6 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/generate_report.py:480 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05