Skills/ClawHub/xhs-product-trend-fit

xhs-product-trend-fit@1.1.5

VERIFIED

Publisher claims: "发笔记前先看商品有没有热度，选对方向再宣传。传入商品图片（必填）+ 介绍文字，自动识别品类/风格/场景方向，用 3~6 个候选词搜索判断近 2 周热度趋势，组织 1 个明确宣传方向，深挖 2~4 篇真实爆款笔记（赞≥100）做分维度拆解（粉丝/标题/首图/内容/抓用户什么点），输出结论文本（data.md）+ 全量数据（res.json）。不需要任何第三方 API key 或付费额度，用你 Chrome 里已登录的账号跑。当用户要宣传商品到 xhs、想先判断商品有没有热度/有没有爆款参考/应该怎么宣传时唤起。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher fatmind · joined 2 days agoInstalls 732Last detonated 36 h ago
$clawhub install xhs-product-trend-fit
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 84/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Outbound HTTP to raw IP addressskill.mjs:14 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressskill.mjs:14 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionskill.mjs:1036 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:44 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionskill.mjs:1042 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:35 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07