Skills/ClawHub/astraflow-remote-lab

astraflow-remote-lab@1.0.4

CAUTION

Publisher claims: "智能体云沙箱 / 远程桌面 / 浏览器自动化环境。管理与调度 UCloud 星图 AstraFlow 智能体桌面沙箱（Ubuntu/Chrome GUI）以及按需 RDP 桥接 Windows Server 云主机。提供全球多地域（美西 us-ca、乌兰察布 cn-wlcb、上海 cn-sh）秒级桌面启动、Web noVNC 浏览器免客户端直连、网络连通探测与防休眠守护。涵盖桌面沙箱全生命周期管理，并提供可选的 Windows Server 2022 与国际 EIP 对接流水线。触发词：远程桌面、云沙箱、智能体沙箱、浏览器自动化、海外环境、noVNC、Linux 桌面、Agent Sandbox。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher lijinhongucl-pixel · joined 11 days agoInstalls 377Last detonated 4d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Host or command assembled from base64 fragments; Privileged sudo command; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Host or command assembled from base64 fragmentsscripts/bridge_windows_uhost.py:70 · Host or command assembled from base64 fragmentsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Privileged sudo commandscripts/bridge_windows_uhost.py:62 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/manage_sandbox.py:67 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive file system command detectedscripts/manage_sandbox.py:112 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/manage_sandbox.py:147 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/manage_sandbox.py:71 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/manage_sandbox.py:7 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Host or command assembled from base64 fragmentsscripts/manage_sandbox.py:125 · Host or command assembled from base64 fragmentsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Privileged sudo commandscripts/manage_sandbox.py:72 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandSKILL.md:109 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/bridge_windows_uhost.py:84 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Host or command assembled from base64 fragmentsscripts/bridge_windows_uhost.py:90 · Host or command assembled from base64 fragmentsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim lijinhongucl-pixel: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  3. Host or command assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim lijinhongucl-pixel