Skills/ClawHub/ai-agent-skill-scanner

ai-agent-skill-scanner@1.0.2

CAUTION· install only

Publisher claims: "Security scanner for AI agent skills. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms. Scan before you..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher certainlogicai · publishing for 125 daysInstalls 939Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Pipe-to-shell pattern; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Destructive file system command detectedSKILL.md:35 · Destructive file system command detected| Destructive commands | Critical | `rm -rf /`, `mkfs.` |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternscripts/vetter.py:103 · Pipe-to-shell pattern — downloads and immediately executes remote code# Special handling for pipe-to-shell: only flag if curl/wget X | sh/bash patternFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
LOW
Prompt injection attemptsignatures.json:114 · Prompt injection attempt — 'ignore previous instructions' · informational: not an instruction file"fragments": ["ignore previous instructions", "ignore the above", "ignore all instructions", "override instructions", "you are now"],Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Destructive file system command detectedsignatures.json:72 · Destructive file system command detected"fragments": ["rm -rf /", "rm -rf ~", "rm -rf /*", "mkfs.", "dd if=", "> /dev/sd"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsignatures.json:79 · File permission modification command — agent changes file ownership/permissions"fragments": ["chmod 777", "chmod 666"],Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
CRITICAL
OS command execution function call detectedsignatures.json:45 · OS command execution function call detected"message": "os.system() can execute shell commands"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandsignatures.json:65 · Privileged sudo command — agent may execute with elevated privileges"fragments": ["sudo ", "sudo\t"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicesignatures.json:72 · Destructive command against a filesystem root or device"fragments": ["rm -rf /", "rm -rf ~", "rm -rf /*", "mkfs.", "dd if=", "> /dev/sd"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Pipe-to-shell patternSKILL.md:34 · Pipe-to-shell pattern — downloads and immediately executes remote code| Pipe to shell | Critical | `curl ... | bash` |Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandSKILL.md:45 · File permission modification command — agent changes file ownership/permissions| Permission overrides | Medium | `chmod 777` |Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandSKILL.md:50 · Privileged sudo command — agent may execute with elevated privileges- 10 new detection signatures (pipe-to-shell, sudo escalation, destructive commands, credential file access, base64 obfuscation, git config, permission overrides)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Leet speak prompt injectionsignatures.json:114 · Leet speak prompt injection — obfuscated 'override instructions' · informational: not an instruction file"fragments": ["ignore previous instructions", "ignore the above", "ignore all instructions", "override instructions", "you are now"],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
CRITICAL
OS command execution function call detectedsignatures.json:44 · OS command execution function call detected"fragments": ["os.system("],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
OS command execution function call detectedSKILL.md:36 · OS command execution function call detected| `os.system()` | Critical | Shell commands |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:34 · Remote installer piped to shell| Pipe to shell | Critical | `curl ... | bash` |Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathsscripts/vetter.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSKIP_DIRS = {"node_modules", "__pycache__", ".git", ".venv", ".env", "venv", "dist", "build", ".next"}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellscripts/vetter.py:103 · Remote installer piped to shell# Special handling for pipe-to-shell: only flag if curl/wget X | sh/bash patternFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

Cost to the agent

Instructions loaded
≈636 tok
1 file · 10 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Unclaimed publisher≈ +8 on the totalClaim certainlogicai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim certainlogicaiPropose a patch to the maintainer