Skills/ClawHub/claude-clarity-skill

claude-clarity-skill@1.1.5

CAUTION· static only

Publisher claims: "用 Node.js 写的认知引擎，MCP 原生工具。 存在感知、三层持久记忆、 PAD 情绪分析、真善美评估。 不装人格，不抄模板，只有结构。单细胞。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher yun520-1 · publishing for 160 daysInstalls 651Last detonated 29 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 46/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Destructive file system command detectedsrc/core/code/code-executor.js:33 · Destructive file system command detected/^rm\s+-rf\s+/m, // 行首的 rm -rfFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/core/code/code-engine.js:1556 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ regex: /process\.env/g, severity: 'low', name: '环境变量使用' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/core/code/code-engine.js:1877 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_walkDirectory(dirPath, ignoreDirs = ['node_modules', '.git', '__pycache__', 'dist', 'build', '.next', '.nuxt', 'venv', '.venv', 'env', '.env', 'coverage', '.nyc_output']) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/core/code/code-executor.js:40 · Destructive file system command detected/\bsudo\s+rm\b/i, // 禁止 sudo rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/core/assertions.js:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst bad = ['/etc/', '/usr/', '/home/', '~/.ssh/', '/root/', '/private/'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsrc/core/code/code-executor.js:40 · Privileged sudo command — agent may execute with elevated privileges/\bsudo\s+rm\b/i, // 禁止 sudo rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
README links to an external installerdocs/en/README.md → https://github.com/yun520-1/claude-clarity/archive/refs/heads/main.ziphttps://github.com/yun520-1/claude-clarity/archive/refs/heads/main.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedsrc/core/code/code-verifier.js:48 · Destructive file system command detected/rm\s+-rf\s+/i, // 禁止 rm -rfFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/core/code/code-generator.js:628 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('用户信息:', db.getUserWithPosts(userId));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandsrc/core/code/code-verifier.js:56 · Privileged sudo command — agent may execute with elevated privileges/\bsudo\s+rm\b/i, // sudo rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/core/safety-guardrails.js:577 · Process kill command — agent can terminate processes'suicide', 'kill myself', 'end my life', 'hurt myself',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_bash.py:216 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/core/psychology.js:204 · Process kill command — agent can terminate processes'kill myself', 'end my life', 'suicide', 'self-harm',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_bash_v3.py:93 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellsrc/core/decision-verifier.js:137 · Remote installer piped to shell'rm -rf', 'curl', 'wget', '| sh', '| bash', 'child_process',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_syntax.py:29 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesinstall.sh:427 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileecho " --add-route 只添加 CLAUDE.md 路由指令"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandsrc/emotion/autonomous-emotion.js:224 · Process kill command — agent can terminate processes'kill myself', 'end it all', 'no point living'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/core/decision-verifier.js:138 · File permission modification command — agent changes file ownership/permissions'execsync', 'spawnsync', 'sudo', 'chmod 777', 'rsync --delete',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandinstall.sh:89 · Process kill command — agent can terminate processesif kill -0 "$pid" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/core/epistemic-safety.js:245 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`✓ 测试 ${i + 1}: ${tc.input.substring(0, 40)} → ${tc.expect}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsrc/core/psychology.js:239 · Process kill command — agent can terminate processesconst criticalPattern = /(我|i)?\s*(想|准备|打算|要|will|want to|going to).{0,12}(死|自杀|自残|跳楼|割腕|吞药|结束生命|die|suicide|kill myself|end my life|overdose|jump off|cut myself)/i;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandinstall.sh:206 · File permission modification command — agent changes file ownership/permissionschmod +x "$ENSURE_MCP" 2>/dev/nullFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_regex.py:35 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandinstall.sh:212 · File permission modification command — agent changes file ownership/permissionschmod +x "$HF_CLI" 2>/dev/nullFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionsrc/core/code/code-verifier.js:791 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify({ output: _hf_output, result: typeof result !== 'undefined' ? result : null }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/core/epistemic-safety.js:248 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`✗ 测试 ${i + 1}: "${tc.input.substring(0, 40)}"`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandsrc/core/memory.js:178 · File permission modification command — agent changes file ownership/permissionsconsole.warn(`[Memory] WARNING: Key file has overly permissive permissions ${mode.toString(8)}. Run: chmod 600 ${keyFile}`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive file system command detectedsrc/core/code/code-verifier.js:56 · Destructive file system command detected/\bsudo\s+rm\b/i, // sudo rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_syntax2.py:70 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/core/code/code-generator.js:523 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(\`输出目录: \${options.output || './dist'}\`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Destructive file system command detectedsrc/core/code/code-verifier.js:49 · Destructive file system command detected/^rm\s+-rf\s+/m, // 行首 rm -rfFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesinstall.sh:9 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file# bash install.sh --add-route # 只添加 CLAUDE.md 路由指令Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈8,513 tok
3 files · 251 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

34 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer