xianmu-comics@0.1.0
VERIFIEDPublisher claims: "闲沐连环画（XianMu Comics）：把 568 部中国经典连环画（小人书，1960s–1990s）接入对话——书目搜索/ 标签浏览/榜单、书页图片、故事梗概语音、逐页朗读、14171 个角色档案与 5690 个可对话角色的 AI 沉浸式 角色扮演。当用户想找书、看/读连环画、小人书、老漫画，想和书中角色（聂小倩、岳飞等）聊天，或想阅读 某本书的完整版时使用；用户提到 闲沐、xianmu、wwzu、连环画、小人书、lianhuanhua、Chinese picture-story books 时也应触发——即使用户没有明说"连环画"三个字。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
Access to sensitive file pathsscripts/xianmu_mcp.py:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsscripts/xianmu_mcp.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05