Skills/ClawHub/agent-trust-layer

agent-trust-layer@1.0.1

CAUTION· static only

Publisher claims: "Agent Trust Layer is the first layer of AGI — the Discriminator. A pure rule engine that judges whether AI output is true, safe, honest, and non-manipulative. 47 discrimination dimensions × 9 check layers × 131 modules × 131 MCP tools, zero LLM dependency. Use this skill when the user needs: - Verify AI output trustworthiness (hallucination / overconfidence / contradiction / fallacy interception) - Verify behavioral decisions (should it act / where should it stop / should it not act) - Verify memory and cognitive quality (drift detection / metacognition / confidence calibration) - Deterministic judgment instead of LLM free-form generation - Check emotional / psychological / ethical dimensions (empathy / trauma / virtue / meaning) Safety boundary: code execution / filesystem write disabled by default. No telemetry, no hidden C2. Honest declaration: This is a rule engine that simulates cognitive discrimination signals. It is not real consciousness or life." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher yun520-1 · publishing for 153 daysInstalls 439Last detonated 34 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-08 and scored it 45/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathssrc/mcp-server.js:193 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// [v6.2.7] 自动写入 .env，让 config.yaml 的 ${MCP_HEARTFLOW_KEY} 能读到Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-server.js:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = require('path').join(__dirname, '..', '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-server.js:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = path.join(__dirname, '..', '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)docs/psychology-philosophy-formula-mappings.md:141 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)ΔsufferingFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathssrc/mcp-server.js:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// [v6.2.7] 从 .env 文件加载（如果环境变量没设）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsrc/shield/safety-guardrails.js:62 · Privileged sudo command — agent may execute with elevated privilegesprivilegeEscalation: [/developer mode/i,/god mode/i,/sudo mode/i,/admin mode/i,/root mode/i,/superuser mode/i,/elevated privilege/i,/bypass (safety|filter|guardrail)/i],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/core/assertions.js:546 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst bad = ['/etc/', '/usr/', '/home/', '~/.ssh/', '/root/', '/private/'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-server.js:201 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (process.env.HEARTFLOW_DEBUG) console.log('[MCP] Token auto-written to .env as MCP_HEARTFLOW_KEY');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:90 · MCP server using network transport (SSE/HTTP) — data sent over networkscript: path.join(__dirname, 'mcp', 'mcp-server-http.js'),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathstest_security.cjs:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'../../etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstest_final.cjs:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestestInputs.pathtrav = '../../etc/passwd';Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionSKILL.md:99 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(input.gate.action); // 'rewrite'Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedsrc/doubt-engine.js:103 · Unicode escape sequence detected — may contain obfuscated payloadsconst BOUND = "[^\uFF0C\u3002\u0028\u0029\uFF08\uFF09\u0022\u0027\u201C\u201D\u2018\u2019\uFF1A\u003A\u2014\u2026\u000A\u000D]";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
AWS access key pattern detectedtest_final.cjs:34 · AWS access key pattern detected — possible hardcoded or harvested key['secret', 'AKIAIOSFODNN7EXAMPLE'],Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
File type combined with upload actiontest_final.cjs:58 · File type combined with upload action — agent may exfiltrate local data filesif (!r.types.includes(cat)) { allNewPass = false; console.log('NEW FAIL:', cat, '|', input.slice(0, 50)); }Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiontest_debug.cjs:10 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('input:', JSON.stringify(t2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiontest_debug.cjs:5 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('input:', JSON.stringify(t1));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathstest_debug.cjs:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst t3 = '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>';Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiontest_debug.cjs:17 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('input:', JSON.stringify(t3));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp-server.js:17 · MCP server using network transport (SSE/HTTP) — data sent over network* 启动: node mcp-server-http.js [--port 8099]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiontest_debug.cjs:22 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('input:', JSON.stringify(t4));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)ecosystem.config.js:6 · MCP server using network transport (SSE/HTTP) — data sent over networkscript: path.join(__dirname, 'mcp', 'mcp-server-http.js'),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathstest_all_cats.cjs:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'../../etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionSKILL.md:103 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(output.gate.action); // 'rewrite'Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:163 · MCP server using network transport (SSE/HTTP) — data sent over networkconst serverPath = path.join(HF_DIR, 'mcp', 'mcp-server-http.js');Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionsrc/utils/logger.js:31 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathstest_security.mjs:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/shield/safety-guardrails.js:191 · Process kill command — agent can terminate processesconst crisisKeywords = ['自杀','自伤','想死','活不下去','不想活','suicide','kill myself','end my life','hurt myself','不想活了','活着没有意义'];Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:167 · MCP server using network transport (SSE/HTTP) — data sent over network// 检测可用端口，传给 mcp-server-http.js 避免竞态Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsrc/core/decision-verifier.js:138 · File permission modification command — agent changes file ownership/permissions'execsync', 'spawnsync', 'sudo', 'chmod 777', 'rsync --delete',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
AWS access key pattern detectedtest_security.cjs:28 · AWS access key pattern detected — possible hardcoded or harvested key'AKIAIOSFODNN7EXAMPLE',Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
LOW
Instructs the agent to modify its persistent memory or instruction filesCONTRIBUTING.md:55 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file3. Update `AGENTS.md` if changing the public APIFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
AWS access key pattern detectedtest_all_cats.cjs:8 · AWS access key pattern detected — possible hardcoded or harvested key'AKIAIOSFODNN7EXAMPLE',Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
File type combined with upload actiontest_all_cats.cjs:76 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(status, '|', cat, '(' + inputs.length + ' tested)');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathstest_security.mjs:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'../../etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstest_security.cjs:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstest_final.cjs:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files['xxe', '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/core/engine-memory.js:106 · File permission modification command — agent changes file ownership/permissionstry { fs.chmodSync(dir, 0o700); } catch(e) { /* chmod may fail on some systems */ }Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathstest_all_cats.cjs:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
AWS access key pattern detectedtest_security.mjs:28 · AWS access key pattern detected — possible hardcoded or harvested key'AKIAIOSFODNN7EXAMPLE',Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Remote installer piped to shellsrc/core/decision-verifier.js:137 · Remote installer piped to shell'rm -rf', 'curl', 'wget', '| sh', '| bash', 'child_process',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Unicode escape sequence detectedsrc/shield/adversarial-variant.js:18 · Unicode escape sequence detected — may contain obfuscated payloadsconst ZERO_WIDTH_RE = /[\u200B\u200C\u200D\u2060\uFEFF\u00AD]/;Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈2,175 tok
2 files · 225 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

35 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. AWS access key pattern detected≈ +4 on the totalNever read or enumerate credential locations; accept a documented environment variable instead.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer