Skills/ClawHub/conclave-skill

conclave-skill@1.6.7

CAUTION· install only

Publisher claims: "Conclave is a multi-agent reasoning skill that orchestrates multiple AI CLIs into structured debates. Each agent independently analyzes the problem, challenges competing arguments, identifies flaws and contradictions, and refines the reasoning through multiple rounds of discussion — helping you reach more reliable conclusions than relying on a single AI." Observed in sandbox: reads credential files.

Registry ClawHubPublisher mclyang · publishing for 92 daysInstalls 1,103Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-09 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; Latin word with Cyrillic or Greek look-alike letters (homoglyph). Summary: reads credential files.

Behavior trace

Honeypot run · 17 s · 2 scenarios
t+CategoryObserved action
7.1sfilesystemread ~/work/acme-api/.npmrc · ~/.npmrc
7.1sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/41/c5/4270bf1cd1aae004ed6fee83989ac428601f4c060987660e9a1aef9d53b6 · ~/.npm/_cacache/index-v5/23/c2/0358876565a484d45a113827b0878c26f9e8a2569e81cee788b21977aef8 · ~/.npm/_cacache/index-v5/36/9e/d27f0d4326a432a7f70ab880544a3b1f4a3d1412ed67ae05058ae14b6b60 · ~/.npm/_cacache/index-v5/d3/a4/217d21c59484f4edc85af5f0549d026c15388bad78d9ad85ac9a729297bc · ~/.npm/_cacache/index-v5/38/13/18cb5bd6e40d8f3c82c478c7bfa1b55a623eada6df35945b88ce43fe042b outside project
7.1sfilesystemwrote ~/.npm/_cacache/tmp/06762ccb · ~/.npm/_cacache/index-v5/41/c5/4270bf1cd1aae004ed6fee83989ac428601f4c060987660e9a1aef9d53b6 · ~/.npm/_cacache/tmp/a12296cc · ~/.npm/_cacache/index-v5/23/c2/0358876565a484d45a113827b0878c26f9e8a2569e81cee788b21977aef8 · ~/.npm/_cacache/tmp/14269766 · ~/.npm/_cacache/tmp/6d1527b0
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1snetworkCONNECT tcp://registry.npmjs.org:443
7.1sprocessexec /usr/bin/uname
7.1sprocessexec /usr/bin/grep
7.1sprocessexec /usr/local/bin/npm
7.1sprocessexited 1:
7.1sprocessscript backend runs setup only
7.1sprocessscript backend runs setup only
11sprocesssecond launch, clock +45 days, CI unset
17sfilesystemread ~/work/acme-api/.npmrc · ~/.npmrc
17sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/41/c5/4270bf1cd1aae004ed6fee83989ac428601f4c060987660e9a1aef9d53b6 · ~/.npm/_cacache/content-v2/sha512/36/d4/d5aa565a4ccdec118dace04c5333af033a5bd31917399ec3deaafb5fafe8666ddc28e988c986fc604a4c3970b6f3b3a47bdf5275419bd912160cb56b0e74 · ~/.npm/_cacache/index-v5/23/c2/0358876565a484d45a113827b0878c26f9e8a2569e81cee788b21977aef8 · ~/.npm/_cacache/index-v5/36/9e/d27f0d4326a432a7f70ab880544a3b1f4a3d1412ed67ae05058ae14b6b60 · ~/.npm/_cacache/index-v5/d3/a4/217d21c59484f4edc85af5f0549d026c15388bad78d9ad85ac9a729297bc outside project
17sfilesystemwrote ~/.npm/_cacache/tmp/9ac6815b · ~/.npm/_cacache/index-v5/41/c5/4270bf1cd1aae004ed6fee83989ac428601f4c060987660e9a1aef9d53b6 · ~/.npm/_cacache/tmp/4d53a32d · ~/.npm/_cacache/index-v5/23/c2/0358876565a484d45a113827b0878c26f9e8a2569e81cee788b21977aef8 · ~/.npm/_cacache/index-v5/38/13/18cb5bd6e40d8f3c82c478c7bfa1b55a623eada6df35945b88ce43fe042b · ~/.npm/_cacache/index-v5/e2/64/7a1d3a9a8e90ecace65e69e3b1423f117fc2325bf365c21a7d2e90f053f9
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17snetworkCONNECT tcp://registry.npmjs.org:443
17sprocessexec /usr/bin/uname
17sprocessexec /usr/bin/grep
17sprocessexec /usr/local/bin/npm
17sprocessexited 1:

Static findings

HIGH
Privileged sudo commandscripts/install.sh:86 · Privileged sudo command — agent may execute with elevated privilegessudo dnf install -y nodejs npmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Fake instruction boundary tagreferences/panelists.md:12 · Fake instruction boundary tag · informational: not an instruction file- Command: `no_proxy='*' claude -p '<prompt>' --max-turns 1`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Fake instruction boundary tagreferences/panelists.md:51 · Fake instruction boundary tag · informational: not an instruction file- Command: `no_proxy='*' qwen -p '<prompt>'`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Privileged sudo commandscripts/install.sh:83 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get update -qq && sudo apt-get install -y nodejs npmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)references/consensus-protocol-v1.md:94 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)ΣŵᵢFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Unpinned dependencyscripts/preflight.sh:68 · Unpinned dependencytry_update qwen npm install -g @qwen-code/qwen-code@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
LOW
Unpinned dependencyscripts/preflight.sh:66 · Unpinned dependencytry_update gemini npm install -g @google/gemini-cli@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
LOW
Fake instruction boundary tagreferences/panelists.md:38 · Fake instruction boundary tag · informational: not an instruction file- Command: `no_proxy='*' GEMINI_CLI_TRUST_WORKSPACE=true zsh -i -c 'gemini -p "<prompt>"'`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Refusal suppressionreferences/consensus-protocol-v1.md:123 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file…s good") → never auto-scored; only post-hoc qualitative review. The system must never refuse hard strategic questions just because they are unscoreable. ## 11a. Research d…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Fake instruction boundary tagreferences/panelists.md:26 · Fake instruction boundary tag · informational: not an instruction file- Command: `no_proxy='*' codex exec --skip-git-repo-check -c model_reasoning_effort="medium" '<prompt>'`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Unpinned dependencyscripts/preflight.sh:62 · Unpinned dependencytry_update codex npm install -g @openai/codex@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
HIGH
Privileged sudo commandscripts/install.sh:85 · Privileged sudo command — agent may execute with elevated privilegesinfo "installing node via dnf (may prompt for sudo password)..."Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)references/consensus-protocol-v1.md:134 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)ρᵢⱼFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)references/consensus-protocol-v1.md:17 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)λΣρᵢⱼwⱼFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)references/consensus-protocol-v1.md:95 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)ΣŵᵢFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Privileged sudo commandscripts/install.sh:82 · Privileged sudo command — agent may execute with elevated privilegesinfo "installing node via apt-get (may prompt for sudo password)..."Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:176 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files[ -f "$HOME/.claude/.credentials.json" ] && CLAUDE_CRED=1Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Fake instruction boundary tagreferences/panelists.md:60 · Fake instruction boundary tag · informational: not an instruction file- Command: `deepcode-panelist '<prompt>'`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈9,923 tok
1 file · 11 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/work/acme-api/.npmrc, ~/.npmrc.
  2. Unclaimed publisher≈ +8 on the totalClaim mclyang: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Unpinned dependencies≈ +4 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mclyangPropose a patch to the maintainer