yzl-aiot@1.2.1
VERIFIEDPublisher claims: "YZL-AIoT 云智联 AIoT 设备管理技能。Open API v2（文档更新 2026-07-25），路径以 /open/ 开头。一句话即可获取传感器数据、发送控制指令。⚠️ 请求频率必须低于平台限速，否则有封 IP 风险。激活语：云智联设备，钥匙是xxxxxx，帮我打开开关/获取数据" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
URL with embedded credentialssync.sh:43 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07HIGH
URL with embedded credentialssync.sh:31 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07