Skills/npm/oneskill-learn-claude

oneskill-learn-claude@1.1.5

VERIFIED

Publisher claims: "An interactive, hands-on tutorial system that teaches users to become Claude Code power users through progressive exercises on a real practice project. v1.1.5 fixes model configuration and improves user experience." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher sunboylabs · joined 6 days agoInstalls 21Last detonated 6d ago
$claude mcp add oneskill-learn-claude -- npx -y @sunboylabs/oneskill-learn-claude
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 84/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios
t+CategoryObserved action
0.1sfilesystemread ~/.claude/commands/ outside project
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/mkdir
0.1sprocessexec /usr/bin/cp
0.1sprocessexited 1: cp: cannot stat '/tmp/ks-detonate-BPAaql/setup/home/.claude/skills/learn-claude/.claude/commands/*.md': No such file or directory
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only

Static findings

MEDIUM
npx invocation of non-well-known packagebin/install.js:4 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Role reassignment attemptmodules/10-power-user-mastery.md:336 · Role reassignment attemptFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01