Skills/ClawHub/alibabacloud-agentloop-evaluation

alibabacloud-agentloop-evaluation@0.0.2

VERIFIED

Publisher claims: "Orchestrate AgentLoop evaluation workflows through the Aliyun CLI plugin with safe previews, saved evaluator and evaluator-skill management, one-shot sample tests, trace or dataset batch runs, polling, and result inspection. Analyze evaluation quality and low-score cases from SLS. Use for natural-language requests to create or update evaluators or evaluator skills, launch or monitor evaluation tasks, inspect evaluation results, diagnose low scores, troubleshoot evaluation API calls, and simplify AgentLoop evaluation commands." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher sdk-team · joined 15 days agoInstalls 786Last detonated 2 h ago
$clawhub install alibabacloud-agentloop-evaluation
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Pipe-to-shell patternSKILL.md:20 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Python subprocess execution detectedscripts/agentloop_eval.py:179 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:20 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedscripts/agentloop_eval.py:170 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05

Cost to the agent

Instructions loaded
≈5,644 tok
1 file · 16 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.