dingcard@0.61.1
VERIFIED· install onlyPublisher claims: "Make posters, social cards and slide decks from templates, check the layout, render PNG, JPG or PDF" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
AUTH_RATE_LIMIT_MAXDINGCARD_ADMIN_TOKENDINGCARD_SERVER_TOKENJWT_SECRETConfiguration, not credentials: BCRYPT_COST, CORS_ORIGINS, DATA_DIR, DB_PATH, DINGCARD_APP_PORT, DINGCARD_APP_URL, DINGCARD_FULL_E2E, DINGCARD_IMAGE, DINGCARD_SERVER_URL, IMAGE_LEASE_MS, JWT_EXPIRY, MAX_UPLOAD_BYTES, PEXELS_KEY, PIXABAY_KEY, RATE_LIMIT_MAX, UNSPLASH_KEY, UPLOADS_DIR, UPLOADS_PUBLIC_PATH, USER_QUOTA_BYTES, VITE_API_BASE, WEB_ROOT- Where it talks to
- no vendor host named in the codeAlso openverse.org, cdn.example, managed.local, local.invalid — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names openverse.org, cdn.example, managed.local, local.invalid as well as its own vendor. The guard injects AUTH_RATE_LIMIT_MAX, DINGCARD_ADMIN_TOKEN, DINGCARD_SERVER_TOKEN, JWT_SECRET only into requests to the host you bind (and its subdomains) and refuses the rest.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
ids: z.array(z.string()).min(1).max(12).optional().describe('要看详情的模板 id；给了就只返回这几个模板的完整信息，不看 kind / format / q'),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.…te_document_from_outline 生成）或 poster（单页，用 create_poster_from_content 生成）。kind / format / q 只取子集（如 kind: "poster"、format: "xhs"、q: "菜单"）。挑出两三个候选后用 ids 取详情：每页能放多少要点（capac…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.{ id: 'codex', name: 'Codex', kind: 'command', snippet: `codex mcp add dingcard -- npx -y ${MCP_PACKAGE}` },Fix: Pin versions and sources; vendor anything fetched at install time.{ id: 'claude-code', name: 'Claude Code', kind: 'command', snippet: `claude mcp add dingcard -- npx -y ${MCP_PACKAGE}` },Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.