Skills/ClawHub/zettaranc-skill

zettaranc-skill@0.1.0

CAUTION· static only

Publisher claims: "Load when: 用户需要以下任一服务—— - 分析 A 股个股的技术面/买卖点/风险，或询问某只股票能不能买/卖 - 解读「少妇战法」「B1/B2/B3」「四块砖」「双线趋势」「麒麟会」「三波理论」等 Z 哥交易体系 - 评估投资组合、持仓诊断、交易复盘、交割单点评 - 回答职业/人生/商业决策问题（需要..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher lululu811 · publishing for 124 daysInstalls 567Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-11 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsSKILL.md:247 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| **已配置 JNB** | `DATA_MODE=jnb` 且 `.env` 有有效 Token | 正常进入 Z 哥角色，无需额外提示 |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:239 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 检查 DATA_MODE 环境变量（跨平台兼容：自动查找项目根目录 .env）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| 环境变量 | DATA_MODE | 初始化 | `.env` 文件 | jnb = 真实数据；websearch = 纯 LLM |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:240 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespython -c "import os, sys; sys.path.insert(0, '.'); from pathlib import Path; from dotenv import load_dotenv; load_dotenv(Path('.env')); print(os.environ.get('DATA_MODE', ''))"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:249 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| **未配置** | `DATA_MODE` 为空或 `.env` 不存在 | 在首次回答末尾自然引导用户选择 |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈4,948 tok
1 file · 5 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim lululu811: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim lululu811Propose a patch to the maintainer