xiaozhi-chemistry-micro-visualizer@2.12.7
VERIFIED· install onlyPublisher claims: "用粒子图景讲清化学现象背后发生了什么：分子、原子、离子，化学变化的本质，质量守恒，溶解；高中延伸到必修与选择性必修（原子结构与化学键、反应中的能量、平衡的动态本质、电离与水解、分子的空间结构与晶体、有机物的结构）。触发语示例："为什么热胀冷缩""化学变化和物理变化在微观上有什么不同""为什么反应前后质量守恒""盐溶在水里去哪了""酸为什么都有相似的性质"。不触发：带具体数据要算的题（转化学解题教练）、化学式或方程式怎么写（转化学用语与方程式教练）、实验怎么做（转化学实验探究教练）。学科判别：问的是"粒子层面为什么"的化学问题归本 SKILL；问的是力、电、光等物理概念转物理概念直觉器。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-chemistry-error-dna 的 references 目录下的 chemistry-error-dimension-table.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm rFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-learning-dna 的 references 目录下的 crisis-referral-protocol.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/contracts 目录下的 lab-safety.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.