Skills/ClawHub/ai-shifu-course-creator

ai-shifu-course-creator@2.3.1

CAUTION· install only

Publisher claims: "Create, edit, publish, and manage AI-Shifu courses" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher heshaofu2 · publishing for 24 daysInstalls 3,292Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Destructive file system command detected; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsAGENTS.md:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `.env.example` | Document supported service-selection, token, and usage-analytics opt-out variables with safe empty defaults, credential-storage guidance, and the user-facing account-linked usage noFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/image_preparation.py:3 · Destructive file system command detectedLocal images may arrive in any format / size (heic from iPhone, 8MB jpeg, etc.)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/profile_store.py:414 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Leave environment-dependent .env configurations as temporary inputs.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/shifu-cli.py:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_EXAMPLE_FILE = ENV_FILE.with_name(".env.example")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/shifu-cli.py:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE = Path(__file__).resolve().parent.parent / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/profile_store.py:376 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env but never a half-written file. The journal makes cleanup retryable.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/shifu-cli.py:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Create the runtime .env from .env.example when it does not exist."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/skill_update_check.py:437 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionAGENTS.md:21 · File type combined with upload action — agent may exfiltrate local data files| `evals/evals.json` | Hold end-to-end behavioral scenarios, optional input fixtures, and expected outcomes for capability use, authoring, platform, analytics, and boundary regressions. Canonical guidFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Authorization escalation languagereferences/cli/cli-reference.md:78 · Authorization escalation language · informational: not an instruction file · informational: not an instruction file · informational: not an instruction fileThe configuration root is `AI_SHIFU_CONFIG_DIR` when set, otherwise `$XDG_CONFIG_HOME/ai-shifu`, otherwise `~/.config/ai-shifu` on all platforms (including `%USERPROFILE%\.config\ai-shifu` on Windows)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsscripts/shifu-cli.py:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Ensure and load environment variables from the skill's .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionAGENTS.md:23 · File type combined with upload action — agent may exfiltrate local data files| `evals/fixtures/learner-introduction.json` | Hold authoring requests and isolated learner inputs for checking reuse of known personal background and learning preferences, focused gap collection, andFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈7,898 tok
2 files · 38 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim heshaofu2: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim heshaofu2Propose a patch to the maintainer