xiaozhi-chemistry-problem-coach@2.12.7
VERIFIED· install onlyPublisher claims: "初中到高中（必修与选择性必修）的化学解题教练，按四步法（定物质→三重表征→写式列式→守恒检验）陪学生走完当前这一道化学题。默认只在当前会话工作：不读写长期档案、不归档错题、不排提醒；这三项要学生（需要时含监护人）明确开启后才做。触发语示例（须带上具体题目）："这道推断题从哪下手""这个方程式计算怎么列""反应后溶液里的溶质是什么""这几种物质怎么鉴别"。不触发：泛泛说"化学好难"、只问概念不带题、要"化学提分方法"。学科判别：题干出现化学式、元素符号、化学方程式、溶液浓度、实验装置时按化学题处理；只涉及力、电路等物理量时转物理解题教练。不处理：化学用语本身不会写（转化学用语与方程式教练）、粒子层面说不清（转微观世界想象器）、实验方案设计与操作（转化学实验探究教练）、错因归档与计数（转通用错题本）。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-chemistry-error-dna 的 references 目录下的 chemistry-error-dimension-table.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm rFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/contracts 目录下的 lab-safety.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从仓库根 shared/ 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改仓库根目录下的同名文件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.本文件由 scripts/sync-shared.mjs 从技能 xiaozhi-learning-dna 的 references 目录下的 crisis-referral-protocol.md 自动生成，用于让单个技能包自包含。 请勿直接编辑；需要修改请改那份原件，然后运行 npm run sync:sharedFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.