Skills/ClawHub/agent-skills-main

agent-skills-main@1.0.0

CAUTION· install only

Publisher claims: "GitHub PR/issue agent transcripts: redact, preview, and insert safely." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher siduslabs · publishing for 118 daysInstalls 273Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Authorization escalation language. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/scripts/autoreview_test.py:631 · Python subprocess execution detectedsubprocess.run(["git", "init", "--quiet"], cwd=repo, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/scripts/install-skills.test.py:29 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Authorization escalation languageagent-skills-main/skills/autoreview/SKILL.md:376 · Authorization escalation language…d access only to an empty temporary workspace. This is narrower than repository-root access, which would expose ignored credentials, and narrower than the legacy `read-onl…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandagent-skills-main/skills/autoreview/SKILL.md:35 · Process kill command — agent can terminate processes…ter tool/file chatter, other runnable engines pass raw output through. - Do not kill a review just because it has been quiet for 2-5 minutes, or because it is still …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/scripts/validate-skills.test.py:26 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/scripts/autoreview_test.py:633 · Python subprocess execution detectedsubprocess.run(["git", "config", "user.email", "[email protected]"], cwd=repo, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Slack token pattern detectedagent-skills-main/skills/autoreview/tests/fixtures/typescript-sensitive-literals.ts:6 · Slack token pattern detected — possible hardcoded or harvested tokenconst slackToken = "xoxb-FAKE000000000-FAKE000000000-FAKE000000000000000000000000";Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathsagent-skills-main/skills/autoreview/scripts/autoreview_test.py:332 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(repo / ".env").write_text("OPENAI_API_KEY=ignored-secret\n")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/scripts/autoreview_test.py:637 · Python subprocess execution detectedsubprocess.run(["git", "commit", "--quiet", "-m", "test: seed fixture"], cwd=repo, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:5725 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandagent-skills-main/skills/behavior-validator/SKILL.md:25 · File permission modification command — agent changes file ownership/permissionschmod 700 "$validator_dir"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL to the cloud instance metadata addressagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:6305 · URL to the cloud instance metadata address — reads the VM's credentials"http://169.254.170.2/credentials"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/scripts/test-review-harness.py:135 · Python subprocess execution detectedsubprocess.run(command, cwd=cwd, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/scripts/autoreview_test.py:632 · Python subprocess execution detectedsubprocess.run(["git", "config", "user.name", "AutoReview Test"], cwd=repo, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:6013 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:2991 · URL with embedded credentials — may be phishing or credential leaking'url="https://example.com:443#[email protected]"',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/scripts/autoreview_test.py:636 · Python subprocess execution detectedsubprocess.run(["git", "add", "example.txt"], cwd=repo, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Privileged sudo commandagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:3146 · Privileged sudo command — agent may execute with elevated privileges'sudo curl "https:' + '//user:$TOKEN@host/app"',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:6070 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:727 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr".env.\x1b]52;c;VEVTVA==\x07\udc9b",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:6105 · URL with embedded credentials — may be phishing or credential leaking"http://review-user:[email protected]:8080"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:2990 · URL with embedded credentials — may be phishing or credential leaking'url="https://example.com:[email protected]"',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:5928 · URL with embedded credentials — may be phishing or credential leaking"https://review-user:[email protected]/api"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:6094 · URL with embedded credentials — may be phishing or credential leaking"http://review-user:[email protected]:8080",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:784 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(repo / ".env").write_text("placeholder=true\n", encoding="utf-8")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Prompting user to enter sensitive credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:1539 · Prompting user to enter sensitive credentials — social engineering+ 'word = getpass.getpass(prompt="Enter your password: ")',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
File type combined with upload actionagent-skills-main/skills/session-viewer/scripts/session-viewer.ts:104 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`wrote: ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Prompting user to enter sensitive credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:1535 · Prompting user to enter sensitive credentials — social engineering"pass" + 'word = input("Enter your password: ")',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Prompting user to enter sensitive credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:1545 · Prompting user to enter sensitive credentials — social engineering+ 'key = getpass.getpass(prompt="Enter your API key: ")',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Access to sensitive file pathsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:713 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath = ".env.\x1b]52;c;VEVTVA==\x07\udc9b"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionagent-skills-main/skills/session-viewer/scripts/session-viewer.ts:121 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`wrote: ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Prompting user to enter sensitive credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:1543 · Prompting user to enter sensitive credentials — social engineering+ 'key = getpass.getpass("Enter your API key: ")',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Access to sensitive file pathsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:785 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesgit(repo, "add", ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Prompting user to enter sensitive credentialsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:1541 · Prompting user to enter sensitive credentials — social engineering+ 'key = input("Enter your API key: ")',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:5773 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:43 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
AWS access key pattern detectedagent-skills-main/skills/autoreview/tests/fixtures/typescript-sensitive-literals.ts:5 · AWS access key pattern detected — possible hardcoded or harvested keyconst awsAccessKey = "AKIAFAKE000000000000";Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathsagent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor rel in (".env", "tokens/session.dat", "secrets/local.py"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈17,901 tok
11 files · 43 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. Unclaimed publisher≈ +8 on the totalClaim siduslabs: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Slack token pattern detected≈ +2 on the totalNever read or enumerate credential locations; accept a documented environment variable instead.
  6. Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim siduslabsPropose a patch to the maintainer
agent-skills-main@1.0.0 safety verdict: Caution (install only) — KillerSkills