Skills/ClawHub/builtin-tools

builtin-tools@1.0.0

VERIFIED

Publisher claims: "跨平台基础工具集 — 16 个独立可组合的 Python 脚本，替代 Agent 平台缺失的基础工具能力。 文件系统（浏览/搜索/读写/替换/删除）、内容搜索（正则）、网络（搜索/抓取/预览）、 运行时安装、持久化记忆、定时任务、任务管理。 纯 Python 标准库，零外部依赖，跨 Windows/macOS/L..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher wangjiaocheng · joined 5 days agoInstalls 892Last detonated 5 h ago
$clawhub install builtin-tools
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-01 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Python subprocess execution detectedscripts/common.py:90 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/execute_command.py:101 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/execute_command.py:167 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/execute_command.py:49 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05