Skills/ClawHub/alibabacloud-mining-attack-diagnosis

alibabacloud-mining-attack-diagnosis@0.0.2

VERIFIED

Publisher claims: "Alibaba Cloud Security Center cryptomining (cryptojacking) diagnosis skill. Use when the user reports or suspects a mining infection, receives a mining alert, or asks for mining alert detection, IOC extraction (pool IPs, malicious domains, sample hashes, malicious processes), affected-asset scoping, attack-surface analysis, entry-vector analysis, risk assessment, prioritized remediation reporting, cryptomining incident response, or mining risk detection. Triggers: "mining", "cryptomining", "cryptojacking", "coin mining", "miner", "mining alert", "mining pool", "pool IPs", "malicious domains", "sample hashes", "malicious processes", "mining IOC", "IOC extraction", "affected-asset scoping", "entry-vector analysis", "risk assessment", "remediation", "xmrig", "kdevtmpfsi", "kinsing", "sysrv", "minerd", "Security Center", "ECS high CPU mining" 中文触发：挖矿、矿池、CPU 跑满、被挖矿、木马进程、异常外联、安全告警、IOC。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher sdk-team · joined 12 days agoInstalls 631Last detonated 4d ago
$clawhub install alibabacloud-mining-attack-diagnosis
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-30 and scored it 83/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Unicode escape sequence detectedscripts/_constants.py:42 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Process kill commandscripts/mining_investigation.py:333 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Unicode escape sequence detectedscripts/_constants.py:48 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/_constants.py:41 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/_constants.py:40 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/_constants.py:43 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedscripts/_cli.py:338 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/mining_investigation.py:426 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05