Skills/ClawHub/cs-cli

cs-cli@1.1.9

CAUTION

Publisher claims: "Use CamScanner through an agent with natural-language requests to find, organize, and process documents more easily. You can start with documents in your CamScanner account, or upload local files to use cloud capabilities such as image enhancement, OCR, format conversion, and image authenticity checks. A CamScanner account login is required to use these features." Observed in sandbox: sends data to data.camscanner.com.

Registry ClawHubPublisher camscanner-ai · joined 0 days agoInstalls 1,891Last detonated 2 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-05 and scored it 55/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern. Summary: sends data to data.camscanner.com.

Behavior trace

Honeypot run · 0 s · 1 scenarios
t+CategoryObserved action
0.1snetworkCONNECT https://data.camscanner.com · undeclared
0.1sprocessexec /usr/bin/uname
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/sed
0.1sprocessexec /usr/bin/head
0.1sprocessexec /usr/bin/tr
0.1sprocessexec /usr/bin/mktemp
0.1sprocessexec /usr/bin/curl
0.1sprocessexec /usr/bin/rm
0.1sprocessexited 22: curl: (22) The requested URL returned error: 403
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only

Static findings

MEDIUM
File permission modification commandscripts/upgrade.sh:328 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/upgrade.sh:316 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/upgrade.sh:325 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/upgrade.sh:147 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
CRITICAL
Pipe-to-shell patternscripts/setup.sh:7 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandscripts/upgrade.sh:300 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellscripts/setup.sh:7 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandscripts/setup.sh:158 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/upgrade.sh:113 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈9,204 tok
1 file · 18 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

25 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim camscanner-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim camscanner-ai