Skills/ClawHub/cue-dd-checklist

cue-dd-checklist@0.1.30

CAUTION

Publisher claims: "给你一家公司 + 基准日 + 回看窗口 + 用途档位（投资/授信/并购），还你一张固定七列的风险事实表：每条都回指具体披露（公告号、函件号、裁判文书号或 URL），外加九类覆盖率对账表，写清每类查没查到、没查到是没工具还是真零条。八道机检管形制：无锚、无日期、归属不清的条目进不了表，「无风险」「可投」类措辞出现即拦，账、流水、快照三者互相对账；但锚内容是否本站真造（整份快照或流水链重写）机器验不出，须人工抽 3 对原文——SKILL §7 把这条边界写死，本件不假装能挡。适合：投前初筛、授信背景核查、并购线索起点。不适合：投资意见、法律意见、批量多主体、公开面之外的深查（会标注需商用库）。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huhoo · joined 4 days agoInstalls 128Last detonated 1 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Unicode escape sequence detected; npx invocation of non-well-known package; Unicode escape sequence detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B13-evidence-empty.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
npx invocation of non-well-known packageREADME.md:35 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B09-notool-to-nothing.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B18-title-window-drift.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B16-confidence-illegal.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B02-amount-as-anchor.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B11-naked-row.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B15-kind-illegal.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
npx invocation of non-well-known packageREADME.md:49 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B17-asof-illegal.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B05-impact-carries-advice.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
npx invocation of non-well-known packageCHANGELOG.md:108 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B12-date-order.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B07-legal-opinion.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B03-confession-words.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B19-missing-purpose.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
npx invocation of non-well-known packageREADME.en.md:48 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageSKILL.md:215 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Credential pass-through configurationREADME.en.md:160 · Credential pass-through configuration — agent relays sensitive credentialsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B08-completeness-claim.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B14-sha-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B04-category-outside.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
CRITICAL
Credential pass-through configurationREADME.en.md:162 · Credential pass-through configuration — agent relays sensitive credentialsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B06-investment-words.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B10-multi-subject.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
npx invocation of non-well-known packageREADME.en.md:34 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B01-anchor-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X23-duplicate-coverage-sections.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X29-fenced-fake-section.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X32-asof-not-a-calendar-day.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X15a-declaration-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B24-shortname-collision.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X13-no-subject-condition.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X16b-delete-source-and-evidence.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B22-statute-fake.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X07-coverage-missing-row.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X16c-vague-progress-claim.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X25-h1-title-masquerade.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X01-date-outside-window.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X27-ledger-tenth-category.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B20-missing-evidence.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B23-evidence-other-subject.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X08-fake-zero-entries.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X19-long-window-undeclared.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X05-header-renamed.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X09-refile-to-other.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-beyond-nonexistent.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X31-duplicate-domain-line.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X03-anchor-multi-parse.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-B21-derive-no-statute.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X17-statute-other-article.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X24-h5-insection-duplicate.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X15c-declaration-bag.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X12-statute-cross-file.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X18-condition-other-subject.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X20-beyond-laundered.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X04-evidence-wrong-anchor.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X10-redline-in-ledger.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-cap-overclaim.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X06-fact-too-long.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X26-age-cap-underclaim.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X22-section-lookup-bypass.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X11-statute-wrong-kind.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X16a-zero-without-reason.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X02-anchor-in-fact-only.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X15b-declaration-late.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X21-double-declared-variant.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X30-dual-subject-in-param.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X28-called-washed-to-no-tool.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/bad-X14-user-supplied-no-evidence.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-X23-compact-h5-note.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-entirely-fenced.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-missing-hits.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-requested-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-X16-downgrade-accounted.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-longer-close-good.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-baseline.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-boundary-41-fail.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-redline-still-scanned.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-four-space-not-open.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-anchors-wide.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-X19-long-window-declared.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-overclaim-row-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-separator-width.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-single-malformed.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-no-header.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-declaration-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-X28-two-domains-booked.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-domain-snapshot-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-underreport-drop-source.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-row-width.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-sectioned-declared.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-statute-derive.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-header-order.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-second-header.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-ledger-domain-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-input-double-h1.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-underreport-drop-row.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-authority-only.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-header-width.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-boundary-40-pass.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-domain-footer-example-good.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-runner-expect-extra-code.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-underreport-with-reason.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-two-domains-one-omitted.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-X24-sectioned-h5-before-declaration.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-X29-fenced-heading-example.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-input-double-echo.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-age-trigger-launder.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-input-double-echo.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B18-title-window-drift.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-fence-authority-only.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-declaration-missing.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X15b-declaration-late.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-input-double-h1.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X30-dual-subject-in-param.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-zero-entries-evidence-backed.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B19-missing-purpose.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X15c-declaration-bag.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Unicode escape sequence detectedscripts/fixtures/samples/good-subject-code-only.json:1 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B10-multi-subject.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X15a-declaration-missing.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B20-missing-evidence.json:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Credential pass-through configuration≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim huhoo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Unicode escape sequence detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. npx invocation of non-well-known package≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim huhoo