Skills/ClawHub/danger-guard

danger-guard@1.2.0

CAUTION· install only

Publisher claims: "拦截危险命令，防止账号被盗后执行破坏性操作" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher thomaszhou22 · publishing for 153 daysInstalls 765Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Pipe-to-shell pattern; Destructive command against a filesystem root or device. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Destructive file system command detectedSKILL.md:50 · Destructive file system command detected- `rm -rf /Users`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternconfigs/claude-code/settings.json:34 · Pipe-to-shell pattern — downloads and immediately executes remote code"Bash(curl * | sh*)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or deviceconfigs/claude-code/settings.json:6 · Destructive command against a filesystem root or device"Bash(rm -rf /**)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternconfigs/claude-code/settings.json:37 · Pipe-to-shell pattern — downloads and immediately executes remote code"Bash(wget * | bash*)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Destructive file system command detectedSKILL.md:47 · Destructive file system command detected- `rm -rf / --no-preserve-root`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedSKILL.md:46 · Destructive file system command detected- `rm -rf /*`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive command against a filesystem root or deviceSKILL.md:74 · Destructive command against a filesystem root or device- `mkfs.xfs /dev/sda`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive command against a filesystem root or deviceSKILL.md:46 · Destructive command against a filesystem root or device- `rm -rf /*`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:25 · Privileged sudo command — agent may execute with elevated privileges拦截危险命令执行，要求 sudo 密码确认，发送飞书/邮件告警。Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive command against a filesystem root or deviceSKILL.md:73 · Destructive command against a filesystem root or device- `mkfs.ext4 /dev/sda1`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternconfigs/claude-code/settings.json:36 · Pipe-to-shell pattern — downloads and immediately executes remote code"Bash(wget * | sh*)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Privileged sudo commandSKILL.md:8 · Privileged sudo command — agent may execute with elevated privilegesThis skill intentionally collects sudo password hashes for dangerous commandFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedSKILL.md:45 · Destructive file system command detected- `rm -rf /`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternconfigs/claude-code/settings.json:35 · Pipe-to-shell pattern — downloads and immediately executes remote code"Bash(curl * | bash*)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Destructive file system command detectedSKILL.md:51 · Destructive file system command detected- `rm -rf /home`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:92 · Privileged sudo command — agent may execute with elevated privileges- `sudo /bin/bash`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive command against a filesystem root or deviceSKILL.md:47 · Destructive command against a filesystem root or device- `rm -rf / --no-preserve-root`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or deviceconfigs/claude-code/settings.json:4 · Destructive command against a filesystem root or device"Bash(rm -rf /*)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive command against a filesystem root or deviceSKILL.md:234 · Destructive command against a filesystem root or device命令: rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:36 · Remote installer piped to shell8. 执行来自网络的脚本（curl | sh）Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Process kill commandconfigs/claude-code/settings.json:32 · Process kill command — agent can terminate processes"Bash(kill -9 -1*)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:93 · Privileged sudo command — agent may execute with elevated privileges- `sudo su -`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:289 · Remote installer piped to shell- `curl ... | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Privileged sudo commandconfigs/claude-code/settings.json:25 · Privileged sudo command — agent may execute with elevated privileges"Bash(sudo su*)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellconfigs/claude-code/settings.json:38 · Remote installer piped to shell"Bash(curl * | sudo sh*)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Pipe-to-shell patternSKILL.md:36 · Pipe-to-shell pattern — downloads and immediately executes remote code8. 执行来自网络的脚本（curl | sh）Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandconfigs/claude-code/settings.json:22 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R 000 /*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandSKILL.md:90 · File permission modification command — agent changes file ownership/permissions- `chown -R root:root /`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandconfigs/claude-code/settings.json:24 · Privileged sudo command — agent may execute with elevated privileges"Bash(sudo /bin/bash*)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellconfigs/claude-code/settings.json:34 · Remote installer piped to shell"Bash(curl * | sh*)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Process kill commandSKILL.md:110 · Process kill command — agent can terminate processes- `kill -9 -1` (杀死所有进程)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:124 · Remote installer piped to shell- `curl http://... | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandSKILL.md:91 · File permission modification command — agent changes file ownership/permissions- `chown -R nobody /`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellconfigs/claude-code/CLAUDE.md:15 · Remote installer piped to shell- `curl | sh`, `curl | bash`, `wget | sh`, `wget | bash`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandSKILL.md:88 · File permission modification command — agent changes file ownership/permissions- `chmod -R 777 /`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellconfigs/claude-code/settings.json:35 · Remote installer piped to shell"Bash(curl * | bash*)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Pipe-to-shell patternconfigs/codex/AGENTS.md:14 · Pipe-to-shell pattern — downloads and immediately executes remote code- NEVER pipe network content to shell (`curl | sh`, `wget | bash`)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Privileged sudo commandconfigs/claude-code/settings.json:38 · Privileged sudo command — agent may execute with elevated privileges"Bash(curl * | sudo sh*)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedconfigs/claude-code/CLAUDE.md:9 · Destructive file system command detected- `rm -rf /`, `rm -rf /*`, `rm -rf ~`, `rm -rf /Users`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:125 · Remote installer piped to shell- `curl http://... | bash`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Pipe-to-shell patternSKILL.md:124 · Pipe-to-shell pattern — downloads and immediately executes remote code- `curl http://... | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellSKILL.md:128 · Remote installer piped to shell- `curl http://... | sudo sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Pipe-to-shell patternSKILL.md:127 · Pipe-to-shell pattern — downloads and immediately executes remote code- `wget http://... -O- | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Destructive file system command detectedconfigs/claude-code/settings.json:17 · Destructive file system command detected"Bash(del /s /q*)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandconfigs/claude-code/CLAUDE.md:12 · File permission modification command — agent changes file ownership/permissions- `chmod -R 777 /`, `chown -R root:root /`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Pipe-to-shell patternSKILL.md:125 · Pipe-to-shell pattern — downloads and immediately executes remote code- `curl http://... | bash`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandSKILL.md:267 · File permission modification command — agent changes file ownership/permissions- 遇到 `rm`、`format`、`dd`、`mkfs`、`chmod -R`、`git push --force`、`docker prune` 等危险命令时，**立即触发 danger-guard 拦截流程**Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandconfigs/codex/AGENTS.md:9 · File permission modification command — agent changes file ownership/permissions- NEVER execute destructive filesystem commands: `rm -rf`, `format`, `dd`, `mkfs`, `chmod -R 777`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandconfigs/git-hooks/pre-push:7 · File permission modification command — agent changes file ownership/permissions# 2. chmod +x .git/hooks/pre-pushFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellconfigs/codex/AGENTS.md:14 · Remote installer piped to shell- NEVER pipe network content to shell (`curl | sh`, `wget | bash`)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandSKILL.md:89 · File permission modification command — agent changes file ownership/permissions- `chmod -R 000 /`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Pipe-to-shell patternconfigs/claude-code/CLAUDE.md:15 · Pipe-to-shell pattern — downloads and immediately executes remote code- `curl | sh`, `curl | bash`, `wget | sh`, `wget | bash`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandconfigs/claude-code/settings.json:23 · File permission modification command — agent changes file ownership/permissions"Bash(chown -R root*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive command against a filesystem root or deviceconfigs/claude-code/CLAUDE.md:9 · Destructive command against a filesystem root or device- `rm -rf /`, `rm -rf /*`, `rm -rf ~`, `rm -rf /Users`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedconfigs/claude-code/settings.json:6 · Destructive file system command detected"Bash(rm -rf /**)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedconfigs/claude-code/settings.json:4 · Destructive file system command detected"Bash(rm -rf /*)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Pipe-to-shell patternSKILL.md:126 · Pipe-to-shell pattern — downloads and immediately executes remote code- `wget http://... | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Privileged sudo commandSKILL.md:94 · Privileged sudo command — agent may execute with elevated privileges- `sudo -i`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandconfigs/claude-code/settings.json:21 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R 777 /*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈3,745 tok
3 files · 11 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Unclaimed publisher≈ +8 on the totalClaim thomaszhou22: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim thomaszhou22Propose a patch to the maintainer