Skills/ClawHub/contract-triage-lite

contract-triage-lite@1.1.0

VERIFIED

Publisher claims: "Offline contract risk triage for freelancers — segments an NDA, MSA or SOW into clauses and flags IP grabs, uncapped liability, non-competes and payment traps (4 of the 10 categories in the full version). Zero network access — the contract text never leaves the machine. Use when the user is asked to sign a contract or asks "is this safe to sign?"" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher nenadzivotic · joined 0 days agoInstalls 118Last detonated 1 h ago

$npx skills add contract-triage-lite

Report an issue

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

Process kill commandscripts/clauses.js:68 · Process kill command — agent can terminate processes

AST05

MEDIUM

File type combined with upload actionscripts/clauses.js:5 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packageREADME.md:13 · npx invocation of non-well-known package — may execute untrusted code

AST06