xiaozhi-chemistry-lab-coach@2.12.7
VERIFIED· install onlyPublisher claims: "化学实验与探究教练：讲清装置为什么这样选、操作为什么是这个顺序、现象和结论怎么区分、检验与除杂怎么设计，覆盖初中 8 个学生必做实验与实验操作考试备考，高中延伸到必修与选择性必修的 18 个学生必做实验。触发语示例："制二氧化碳为什么不用稀硫酸""为什么要先检查装置气密性""这个实验的现象和结论怎么写""除去杂质选什么试剂""实验操作考试要注意什么"。不触发：纯计算题（转化学解题教练）、化学式与方程式写法（转化学用语与方程式教练）。学科判别：涉及化学仪器、装置、药品、操作、现象、检验与除杂的问题归本 SKILL；力学、电学实验转物理实验思维教练。不处理：在家自行操作的化学实验步骤（一律不给，见 shared/lab-safety.md）；错题归档与计数（转通用错题本）。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
本文件由 scripts/sync-shared.mjs 从仓库根 shared/contracts 目录下的 lab-safety.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-learning-dna 的 references 目录下的 crisis-referral-protocol.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-chemistry-error-dna 的 references 目录下的 chemistry-error-dimension-table.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm rFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.