Skills/ClawHub/code-risk-agent

code-risk-agent@0.1.0

CAUTION· install only

Publisher claims: "当用户需要扫描代码安全漏洞、审计代码、分析 C/Python 风险、检查依赖漏洞、或生成安全报告时触发。支持云端 LLM 语义分析和本地 GPU 回退。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher a9320 · publishing for 87 daysInstalls 408Last detonated 16 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: OS command execution function call detected; OS command execution function call detected; OS command execution function call detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

CRITICAL
OS command execution function call detectedagents/static_analyzer.py:146 · OS command execution function call detected"desc": "os.system() directly executes shell commands",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedagents/static_analyzer.py:145 · OS command execution function call detected"title": "OS Command Injection via os.system()",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedagents/static_analyzer.py:147 · Python subprocess execution detected"fix": "Use subprocess.run() instead",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagents/static_analyzer.py:140 · Python subprocess execution detected"fix": "Use subprocess.run(args, shell=False) with a list",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
OS command execution function call detectedcore/taint_analyzer.py:78 · OS command execution function call detectedr"\bos\.system\s*\(": ("CWE-78", "high", "Command injection via os.system()"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedcore/taint_analyzer.py:13 · OS command execution function call detected- Python: eval(), exec(), os.system(), subprocess, pickle.loads()Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:45 · MCP server using network transport (SSE/HTTP) — data sent over network`mcp-server/server.py` 支持 `--sse` 参数启用 SSE 传输模式，**仅供本地调试使用**：Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedcore/semgrep_runner.py:42 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedagents/static_analyzer.py:139 · Python subprocess execution detected"desc": "subprocess.call() with shell=True may be injected",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedcore/llm_client.py:118 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈796 tok
1 file · 23 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim a9320: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim a9320Propose a patch to the maintainer