Skills/ClawHub/clawrtc

clawrtc@1.9.0

CAUTION· static only

Publisher claims: "Mine RustChain RTC tokens on real x86/ARM or vintage hardware by proving physical device control with ClawRTC mining client." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher scottcjn · publishing for 159 daysInstalls 2,227Last detonated 23 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 50/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: URL to the cloud instance metadata address; URL to the cloud instance metadata address; HTTP URL with a raw public IP address. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Python subprocess execution detectedclawrtc/data/bcos_engine.py:80 · Python subprocess execution detectedp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/miner_crypto.py:46 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/fingerprint_checks.py:162 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/miner.py:389 · Python subprocess execution detectedoutput = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/miner.py:204 · Python subprocess execution detectedoutput = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
URL to the cloud instance metadata addressclawrtc/data/fingerprint_checks.py:458 · URL to the cloud instance metadata address — reads the VM's credentials"http://169.254.169.254/latest/api/token",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with suspicious TLDclawrtc/data/pow_miners.py:82 · URL with suspicious TLD — commonly used for phishing/malware"acc-pool": "https://kaspa.acc-pool.pw/api/accounts/{address}",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedclawrtc/data/fingerprint_checks.py:329 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/cli.py:129 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/pow_miners.py:253 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/fingerprint_checks.py:345 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with suspicious TLDclawrtc/data/pow_miners.py:72 · URL with suspicious TLD — commonly used for phishing/malware"acc-pool": "https://warthog.acc-pool.pw/api/accounts/{address}",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
CRITICAL
URL to the cloud instance metadata addressclawrtc/data/fingerprint_checks.py:440 · URL to the cloud instance metadata address — reads the VM's credentials"http://169.254.169.254/",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedclawrtc/data/pow_miners.py:258 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
HTTP URL with a raw public IP addressclawrtc/data/miner.py:77 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameRUSTCHAIN_API = "http://50.28.86.131:8088"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedclawrtc/cli.py:88 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/fingerprint_checks.py:147 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedclawrtc/data/fingerprint_checks.py:471 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using a raw public IP addressclawrtc/data/miner.py:77 · URL using a raw public IP address — may bypass domain-based filteringRUSTCHAIN_API = "http://50.28.86.131:8088"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈806 tok
1 file · 17 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

30 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. URL to the cloud instance metadata address≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim scottcjn: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. HTTP URL with a raw public IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. URL with suspicious TLD≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. URL using a raw public IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim scottcjnPropose a patch to the maintainer