Is yotta-humanize@0.2.2 safe to install?

yotta-humanize@0.2.2

VERIFIED

Publisher claims: "元真 —— 去 AI 味的中文写作编辑技能：检测器引擎（24 类规则 + 词表 + 统计突发性）识别并改写 AI 腔文本，让中文写作更自然、更像人写的。触发：编辑 / 润色文本、去 AI 味、让文章 / 文案 / 回复更像人写、发现文本充斥着 AI 常用词与句式（赋能 / 闭环 / 值得注意的是 / 综上所述 / 希望对你有所帮助等）、给 AI 生成的中文稿件做检测与改写。边界：只处理文本，不生成新内容；不改写事实 / 数据 / 专有名词；不破坏作者原意；改写为确定性规则，不依赖模型。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yottameta · joined 5 days agoInstalls 860Last detonated 31 h ago

$clawhub install yotta-humanize

Watch Report an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessexec /usr/bin/dirname

0.0sprocessexec /usr/bin/uname

0.0sprocessexited 4: 目标错误: 未检测到项目级智能体目录。可用 --agent <name> 装到用户级，或用 --dir <路径> 指定目录。

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

npx invocation of non-well-known packagebin/install.js:10 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagebin/install.js:6 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagebin/install.js:8 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagebin/install.js:9 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagebin/install.js:7 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06