Skills/npm/skill-code-lit

skill-code-lit@1.0.0

VERIFIED

Publisher claims: "数字人开发基础规则技能｜fmode-code-lit 规则库：Lit 原生 ESM 无构建前端开发规范（单入口 Web Component / 子路径 History 路由 / OBS+CDN 部署 / 零构建），沉淀多页面开发 light DOM 五条死线等实战教训，让 AI 生成代码时不重犯同类错误。含全局技能、脚手架与规则安装器。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher fmode · joined 3 days agoInstalls 0Last detonated 3d ago
$claude mcp add skill-code-lit -- npx -y @fmode/skill-code-lit
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-31 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/skill-package-manifest.json:12 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/bin/fmode-code-lit.js:5 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/skill-package-manifest.json:16 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageCLAUDE.md:111 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/scripts/scaffold.mjs:278 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepackage.json:62 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/bin/fmode-code-lit.js:6 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/bin/fmode-code-lit.js:8 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/scripts/scaffold.mjs:306 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/skill-package-manifest.json:13 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/bin/fmode-code-lit.js:7 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fmode-code-lit/bin/fmode-code-lit.js:9 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06