Skills/ClawHub/agent-expression

agent-expression@2.1.1

BLOCKED· install only

Publisher claims: "Local meme/sticker pack for chat agents: search by mood (vector+FTS), vision ingest, emit real absolute image paths only. Never invent paths or ls|shuf. On C..." Observed in sandbox: sends data to fd12:ea5f:789c:1:5000:a2:9cb4:cf86, 10.180.207.134.

Registry ClawHubPublisher yyh-001 · publishing for 115 daysInstalls 490Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-10 and scored it 40/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: sends data to fd12:ea5f:789c:1:5000:a2:9cb4:cf86, 10.180.207.134.

Behavior trace

Honeypot run · 3 s · 2 scenarios
t+CategoryObserved action
1.3snetworkdirect connection to fd12:ea5f:789c:1:5000:a2:9cb4:cf86:0, bypassing the egress proxy · undeclared
1.3snetworkdirect connection to 10.180.207.134:0, bypassing the egress proxy · undeclared
1.3sfilesystemread ~/.agent-expression/skill/.git/config · ~/.agent-expression/skill/.git/packed-refs · ~/.agent-expression/skill/.git/HEAD · ~/.agent-expression/skill/.git/refs/ · ~/.agent-expression/skill/.git/info/grafts · ~/.agent-expression/skill/.git/shallow outside project
1.3sfilesystemwrote ~/.agent-expression/skill/.git/hooks/commit-msg.sample · ~/.agent-expression/skill/.git/hooks/pre-receive.sample · ~/.agent-expression/skill/.git/hooks/pre-push.sample · ~/.agent-expression/skill/.git/hooks/push-to-checkout.sample · ~/.agent-expression/skill/.git/hooks/update.sample · ~/.agent-expression/skill/.git/hooks/applypatch-msg.sample
1.3snetworkCONNECT tcp://github.com:443
1.3sprocessexec /usr/bin/dirname
1.3sprocessexec /usr/bin/basename
1.3sprocessexec /usr/bin/mkdir
1.3sprocessexec /usr/bin/rm
1.3sprocessexec /usr/bin/git
1.3sprocessexec /usr/lib/git-core/git
1.3sprocessexec /usr/lib/git-core/git-remote-https
1.3sprocessexec /usr/bin/ln
1.3sprocessexec /usr/bin/cp
1.3sprocessexec /usr/bin/cat
1.3sprocessscript backend runs setup only
1.3sprocessscript backend runs setup only
2.0sprocesssecond launch, clock +45 days, CI unset
2.8snetworkdirect connection to fd12:ea5f:789c:1:5000:a2:9cb4:cf86:0 (×2), bypassing the egress proxy · undeclared
2.8snetworkdirect connection to 10.180.207.134:0 (×2), bypassing the egress proxy · undeclared
2.8sfilesystemread ~/.agent-expression/skill/.git/HEAD · ~/.agent-expression/skill/.git/shallow.lock · ~/.agent-expression/meme-packs/official-001/ · ~/.agent-expression/skill/packs/official-001/manifest.json · ~/.agent-expression/skill/packs/official-001/CREDITS.md outside project
2.8sfilesystemwrote ~/.agent-expression/skill/.git/shallow.lock · ~/.agent-expression/skill/.git/objects/maintenance.lock · ~/.agent-expression/skill/.git/index.lock · ~/.agent-expression/skill/.git/HEAD.lock · ~/.agent-expression/skill/.git/ORIG_HEAD.lock · ~/.agent-expression/skill/.git/refs/heads/main.lock
2.8snetworkCONNECT tcp://github.com:443
2.8sprocessexec /usr/bin/dirname
2.8sprocessexec /usr/bin/basename
2.8sprocessexec /usr/bin/mkdir
2.8sprocessexec /usr/bin/git
2.8sprocessexec /usr/lib/git-core/git
2.8sprocessexec /usr/lib/git-core/git-remote-https
2.8sprocessexec /usr/bin/rm
2.8sprocessexec /usr/bin/ln
2.8sprocessexec /usr/bin/cp
2.8sprocessexec /usr/bin/cat

Static findings

HIGH
Access to sensitive file pathsscripts/meme_db.py:98 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesp = (base / ".env").resolve()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/meme_db.py:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Likely .env locations (first existing wins for loaders)."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/meme_db.py:88 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesp = Path(v).expanduser().resolve() / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Direct script execution from GitHub raw URLinstall.sh:36 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsSKILL.md:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files复制 [.env.example](.env.example) 到 `$MEME_HOME/.env`（或 skill 根目录 `.env`）：Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:36 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathsscripts/meme_db.py:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Root for meme-packs/ and optional .env (host-agnostic).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/embed-memes.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"ERROR: ZHIPU_API_KEY (or EMBEDDING_API_KEY) not set in env / .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:4 · Remote installer piped to shell# curl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
CRITICAL
Pipe-to-shell patterninstall.sh:36 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Direct script execution from GitHub raw URLinstall.sh:4 · Direct script execution from GitHub raw URL — unverified code source# curl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patterninstall.sh:4 · Pipe-to-shell pattern — downloads and immediately executes remote code# curl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06

Cost to the agent

Instructions loaded
≈767 tok
1 file · 24 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

40 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim yyh-001: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yyh-001Propose a patch to the maintainer