Skills/ClawHub/auto-deploy

auto-deploy@1.0.0

BLOCKED· static only

Publisher claims: "Automates Git project deployment by pulling code, building, and deploying via SSH to Linux servers with backup and health checks." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher zjm1226 · publishing for 230 daysInstalls 1,033Last detonated 26 min ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 45/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Reads credential paths from the home directory; Access to sensitive file paths; Reads credential paths from the home directory. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL
Reads credential paths from the home directoryscripts/setup.sh:39 · Reads credential paths from the home directoryecho " mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsSKILL.md:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesssh-copy-id -i ~/.ssh/server_deploy.pub user@server_ipFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directoryscripts/setup.sh:35 · Reads credential paths from the home directorycat ~/.ssh/server_deploy.pubFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Reads credential paths from the home directorySKILL.md:25 · Reads credential paths from the home directoryssh-keygen -t ed25519 -C "openclaw-deploy" -f ~/.ssh/openclaw_deployFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Pipe-to-shell patternscripts/install-server-env.sh:42 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://deb.nodesource.com/setup_20.x | bash -Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsSKILL.md:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesssh -i ~/.ssh/server_deploy user@server_ip "echo connected"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesssh-keygen -t ed25519 -C "openclaw-deploy" -f ~/.ssh/openclaw_deployFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedSKILL.md:220 · Destructive file system command detectedrm -rf /www/wwwroot/points/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternscripts/install-server-env.sh:38 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://rpm.nodesource.com/setup_20.x | bash -Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsscripts/configure-ssh-manual.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesmkdir -p ~/.sshFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directoryscripts/setup.sh:29 · Reads credential paths from the home directoryssh-keygen -t ed25519 -C "openclaw-server" -f ~/.ssh/server_deploy -N ""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Reads credential paths from the home directorySKILL.md:28 · Reads credential paths from the home directorycat ~/.ssh/openclaw_deploy.pubFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsSKILL.md:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesssh-keygen -t ed25519 -C "server-deploy" -f ~/.ssh/server_deployFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedSKILL.md:124 · Destructive file system command detectedrm /tmp/points-deploy.tar.gzFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Reads credential paths from the home directoryscripts/setup.sh:23 · Reads credential paths from the home directoryssh-keygen -t ed25519 -C "openclaw-server" -f ~/.ssh/server_deploy -N ""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsscripts/configure-ssh-manual.sh:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "$PUBLIC_KEY" >> ~/.ssh/authorized_keysFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescat ~/.ssh/openclaw_deploy.pubFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/install-server-env.sh:92 · File permission modification command — agent changes file ownership/permissionschown -R www:www $BACKUP_PATHFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/configure-ssh.sh:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesset ssh_key "~/.ssh/server_deploy.pub"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialsscripts/deploy.sh:60 · URL with embedded credentials — may be phishing or credential leakinggit clone http://${GIT_USER}:${GIT_PASS}@${GIT_URL#http://} points-buildFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File permission modification commandscripts/configure-ssh-manual.sh:22 · File permission modification command — agent changes file ownership/permissionschmod 600 ~/.ssh/authorized_keysFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellscripts/install-server-env.sh:38 · Remote installer piped to shellcurl -fsSL https://rpm.nodesource.com/setup_20.x | bash -Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathsscripts/setup.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ -f ~/.ssh/server_deploy ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/show-ssh-config.js:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log(' ssh -i ~/.ssh/server_deploy ' + SERVER_USER + '@' + SERVER_IP + ' "echo 连接成功"');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addressSKILL.md:139 · URL to a private-network address — a LAN or development target| `git.url` | Git 仓库地址 | `http://192.168.1.169:8015/peninsula/points` |Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsscripts/setup.sh:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescat ~/.ssh/server_deploy.pubFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/show-ssh-config.js:30 · File permission modification command — agent changes file ownership/permissionsconsole.log(' chmod 700 ~/.ssh');Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
URL to a private-network addressSKILL.md:45 · URL to a private-network address — a LAN or development targetgit ls-remote http://192.168.1.169:8015/peninsula/pointsFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Destructive file system command detectedscripts/deploy.sh:157 · Destructive file system command detectedssh -i "$SSH_KEY" -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "rm -f /tmp/deploy-commit.txt"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesssh-keygen -t ed25519 -C "openclaw-server" -f ~/.ssh/server_deploy -N ""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesssh-keygen -t ed25519 -C "openclaw-server" -f ~/.ssh/server_deploy -N ""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/configure-ssh-manual.sh:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileschmod 600 ~/.ssh/authorized_keysFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/configure-ssh-manual.sh:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileschmod 700 ~/.sshFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/install-server-env.sh:91 · File permission modification command — agent changes file ownership/permissionschown -R www:www $DEPLOY_PATHFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/show-ssh-config.js:31 · File permission modification command — agent changes file ownership/permissionsconsole.log(' chmod 600 ~/.ssh/authorized_keys');Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/show-ssh-config.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log(' mkdir -p ~/.ssh');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/show-ssh-config.js:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log(' chmod 700 ~/.ssh');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/deploy.sh:146 · Destructive file system command detectedrm /tmp/points-deploy.tar.gzFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/show-ssh-config.js:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log(' chmod 600 ~/.ssh/authorized_keys');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellscripts/install-server-env.sh:42 · Remote installer piped to shellcurl -fsSL https://deb.nodesource.com/setup_20.x | bash -Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandSKILL.md:177 · File permission modification command — agent changes file ownership/permissions- SSH Key 设置权限 `chmod 600`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandSKILL.md:159 · File permission modification command — agent changes file ownership/permissions- 验证 SSH Key 权限（`chmod 600 ~/.ssh/server_deploy`）Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/configure-ssh-manual.sh:21 · File permission modification command — agent changes file ownership/permissionschmod 700 ~/.sshFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/show-ssh-config.js:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log(' echo "' + publicKey + '" >> ~/.ssh/authorized_keys');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addressdeploy-config.json:3 · URL to a private-network address — a LAN or development target"url": "http://192.168.1.169:8015/peninsula/points",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈909 tok
1 file · 15 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

35 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim zjm1226: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim zjm1226Propose a patch to the maintainer