xiaozhi-biology-inquiry-coach@2.12.7
VERIFIED· install onlyPublisher claims: "生物实验探究教练：讲清探究的步骤、对照实验怎么设计、每一步为什么这样做、结论怎么写，覆盖初中常见实验与实验操作考试备考，以及高中必修与选择性必修的学生活动与实验设计题。触发语示例："这个探究实验的对照组怎么设""为什么要暗处理""实验设计题怎么写才完整""生物实验操作考试要注意什么""这个实验的自变量是什么"。学科判别：涉及生物实验的设计、步骤、现象记录、结论与实验安全时归本 SKILL；物理、化学实验分别转物理实验思维教练、化学实验探究教练；实验数据表怎么读转生物图表与材料题教练。不处理：在家自行操作的微生物培养、采集血液等实验步骤（一律不给，见 shared/lab-safety.md）；错题归档与计数（转通用错题本）。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-biology-error-dna 的 references 目录下的 biology-error-dimension-table.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/contracts 目录下的 lab-safety.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-learning-dna 的 references 目录下的 crisis-referral-protocol.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.