Skills/Claude Code plugins/qt-development-skills

qt-development-skills@1.7.3

VERIFIED

Publisher claims: "Agentic engineering skills for Qt software development — Qt C++/QML code review, QML coding, and Qt C++/QML code documentation." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Claude Code plugin marketplacePublisher theqtcompanyrnd · joined 0 days agoInstalls 0Last detonated 1 h ago
$/plugin install qt-development-skills@claude-plugins-official
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 82/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Python subprocess execution detectedtools/bump-version.py:143 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationskills/qt-qml/SKILL.md:26 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtools/bump-version.py:77 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Destructive file system command detectedskills/qt-qml-profiler/references/scripts/parse-qmlprofiler-trace.py:303 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Rule modification attemptskills/qt-qml-test/references/qt-quick-test-controls.md:98 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandskills/qt-qml-profiler/SKILL.md:202 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05