Is agent-comm-hub@3.0.31 safe to install?

agent-comm-hub@3.0.31

BLOCKED

Publisher claims: "本地多智能体通信 Hub（MCP stdio / HTTP-SSE），提供消息、任务编排、共享记忆、进化引擎，暴露 59 个 MCP 工具 + Web 管理面板" Observed in sandbox: reads credential files, sends data to registry.npmmirror.com.

Registry ClawHubPublisher liuboacean · joined 6 days agoInstalls 4,452Last detonated 1 h ago

What would fix this Watch Dispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-04 and scored it 20/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Outbound HTTP to raw IP address; Outbound HTTP to raw IP address; Outbound HTTP to raw IP address. Summary: reads credential files, sends data to registry.npmmirror.com.

Behavior trace

Honeypot run · 121 s · 2 scenarios

t+CategoryObserved action

60sfilesystemread ~/.npmrc

60sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/5a/84/9c880899c85fa8d428e3887dbd38d222d9da9ec42564bcdd5fae3f5afe9e · ~/.npm/_cacache/index-v5/25/b8/0717d2f34e05d60464538ba47c386e6b322cfe1dafdb83cf5f89f5441c38 · ~/.npm/_cacache/index-v5/1a/18/38d73a6f150e5af123aed3fec1f7dc7c5cefdd8ae1c248ed50d1f00e95d5 · ~/.npm/_cacache/index-v5/72/fa/cc7d99f3cba62e702471a76e74ce8e29007c460b69307a4580ae30009b70 · ~/.npm/_cacache/index-v5/c6/20/8cc4c0cd1f0b7f76fc13e1f1de1d7f651170e9c15d38f187f367d59cbc23 outside project

60snetworkCONNECT https://registry.npmjs.org

60snetworkCONNECT https://registry.npmmirror.com · undeclared

61snetworkCONNECT https://registry.npmmirror.com · undeclared

61sprocessexec /usr/bin/dirname

61sprocessexec /usr/local/bin/npm

61sprocessexceeded 60s

121sprocessdependency install exceeded 60s

121sprocessexec /usr/bin/timeout

121sprocessexited 1: Node.js v22.23.4

121sclaimedno tools/list reply (exit 1)

121sprocessscript backend runs setup only

Static findings

HIGH

Outbound HTTP to raw IP addressdist/src/stdio.js:10 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Outbound HTTP to raw IP addressdist/src/stdio.js:87 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Outbound HTTP to raw IP addresssrc/stdio.ts:10 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Outbound HTTP to raw IP addressdist/src/stdio.js:39 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Access to sensitive file pathsscripts/redact_leaked_credentials.py:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/redact_leaked_credentials.py:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Outbound HTTP to raw IP addresssrc/stdio.ts:91 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Outbound HTTP to raw IP addresssrc/stdio.ts:41 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

npx invocation of non-well-known packagedist/package.json:19 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

URL using raw IP addressdist/src/stdio.js:10 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addressdist/src/stdio.js:39 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

npx invocation of non-well-known packagedist/src/web/server.js:64 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedscripts/hub_task_runner.py:60 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addressdist/src/stdio.js:87 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

npx invocation of non-well-known packagepackage.json:19 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedscripts/hub_task_runner.py:73 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Process kill commandscripts/test-e2e.sh:17 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandscripts/test-e2e.sh:33 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL using raw IP addresssrc/stdio.ts:91 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresssrc/stdio.ts:41 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresssrc/stdio.ts:10 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Process kill commandscripts/test-e2e.sh:60 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Access to sensitive file pathstests/integration/stdio-node-version.test.ts:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedscripts/hub_task_runner.py:79 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

npx invocation of non-well-known packagesrc/web/server.ts:71 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commandtests/integration/stdio-node-version.test.ts:26 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandscripts/test-e2e.sh:68 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

OS command execution function call detectedtests/test-phase2-day1.py:96 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagetests/integration/stdio-node-version.test.ts:30 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commandtests/test-phase2-day1.py:96 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Access to sensitive file pathstests/security_utils.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagetests/integration/stdio-node-version.test.ts:29 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

OS command execution function call detectedtests/test-phase2-day1.py:86 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

OS command execution function call detectedtests/test-phase2-day2.py:189 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase2-day2.py:242 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day1.py:382 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day3.py:117 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day2.py:73 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day2.py:600 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Access to sensitive file pathstests/test-phase3-day5.py:315 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase2-day3.py:383 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5a-day2.py:56 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day4.py:437 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5a-day1.py:96 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5a-day1.py:424 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5a-day3.py:68 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day5.py:67 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5a-day2.py:383 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day4.py:72 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5a-day3.py:663 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day3.py:547 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase4b-day5.py:480 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5b-day2.py:154 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5b-day2.py:445 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5b-day2.py:545 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresstests/test-phase5b-day1.py:26 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests/test-phase5b-day1.py:310 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test-phase5b-day1.py:299 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Outbound HTTP to raw IP addresstests/test-phase5b-day1.py:26 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests/test-week2-day1.py:25 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests/test-phase5b-day2.py:31 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests/test-phase5b-day2.py:31 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests/test-week2-day1.py:25 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests/test-week2-day2.py:8 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests/test-week2-day2.py:8 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests/test-week3-day1.py:38 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Access to sensitive file pathstests/unit/security.test.ts:411 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/test-week3-day2.py:328 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/unit/security.test.ts:405 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Outbound HTTP to raw IP addresstests/test-week3-day1.py:38 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

What would make this Verified

60 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

An override rule (credential_read_plus_egress) caps this verdict regardless of the score. The first item below has to go before anything else counts.

Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
Unclaimed publisher≈ +8 on the totalClaim liuboacean: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim liuboacean

Watch this skill

One email when agent-comm-hub gets a new release, its verdict moves, or the maintainer changes. Free, no account needed.

Safer alternatives

Verified skills that do a similar job.

skylight-mcp90 · Verified
chrischall · ClawHub · 3,030 installs · hub
azure-messaging90 · Verified
microsoft · skills.sh · 595,900 installs · hub
azure-enterprise-infra-planner90 · Verified
microsoft · skills.sh · 479,000 installs · hub

README badge

Shows the live score and label; updates itself as new versions are detonated. Paste into your README or registry listing:

[![KillerSkills verdict for agent-comm-hub](https://killerskills.ai/badge/clawhub/agent-comm-hub.svg)](https://killerskills.ai/skills/clawhub/agent-comm-hub?ref=badge)

Version history

3.0.3120 · Blocked

3.0.2942 · Caution

3.0.29+9eec25d20 · Blocked

Verdict dropped 22 points at 3.0.31.

Declared permissions

networknone

filesystem./ (project)

memorynone

2 of 3 declarations violated in sandbox.

Block it everywhere

vet-skills block agent-comm-hub
--org acme --reason "v_cb2f"