Skills/ClawHub/claude-code-unicode-audit

claude-code-unicode-audit@1.0.2

VERIFIED· install only

Publisher claims: "检查本机 Claude Code 二进制是否含有向系统提示词日期行注入近不可见 Unicode 撇号（U+2019/U+02BC/U+02B9）的隐写标记代码，并在受影响时升级到干净版本。受影响区间 v2.1.193–2.1.196，v2.1.197 起已回滚。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher wwbwin · publishing for 147 daysInstalls 1,004Last detonated 3d ago
$clawhub install claude-code-unicode-audit
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

LOW
Unpinned dependencySKILL.md:32 · Unpinned dependency- 执行 `npm install -g @anthropic-ai/claude-code@latest` 并复检Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
Python subprocess execution detectedscripts/audit_cc_date_prompt.py:41 · Python subprocess execution detectedroot = subprocess.check_output(["npm","root","-g"], text=True).strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/audit_cc_date_prompt.py:51 · Python subprocess execution detectedout = subprocess.check_output(["claude","--version"], text=True, stderr=subprocess.STDOUT)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Unpinned dependencyscripts/audit_cc_date_prompt.py:105 · Unpinned dependencyprint(">> Remediation: upgrade to >= 2.1.197 (e.g. `npm install -g @anthropic-ai/claude-code@latest`) and re-audit.")Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
Python subprocess execution detectedscripts/upgrade_cc.py:17 · Python subprocess execution detectedreturn subprocess.run(cmd)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Unpinned dependencyscripts/upgrade_cc.py:24 · Unpinned dependencyprint("DRY RUN -- would run: npm install -g @anthropic-ai/claude-code@latest")Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06

Cost to the agent

Instructions loaded
≈401 tok
1 file · 6 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.