Skills/ClawHub/down

down@0.2.0

CAUTION

Publisher claims: "Analyze a URL and download it with minimal steps." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher cgartlab · joined 3 days agoInstalls 24Last detonated 3d ago
WatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-23 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Outbound HTTP to raw IP address; Outbound HTTP to raw IP address; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Outbound HTTP to raw IP addressevals/test_proxy_chain.py:39 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressdocs/PLAN-v0.2.md:189 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
URL with embedded credentialsevals/test_detect.py:254 · URL with embedded credentials — may be phishing or credential leaking
AST07
HIGH
Outbound HTTP to raw IP addressdocs/PLAN-v0.2.md:203 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressreferences/commands-windows.md:146 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressdocs/PLAN-v0.2.md:186 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressdocs/PLAN-v0.2.md:202 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressevals/test_proxy_chain.py:61 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressevals/test_proxy_chain.py:66 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressevals/test_proxy_chain.py:40 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressdocs/PLAN-v0.2.md:188 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressevals/test_proxy_chain.py:41 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addressdocs/PLAN-v0.2.md:189 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressevals/test_proxy_chain.py:61 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Outbound HTTP to raw IP addressreferences/commands-windows.md:154 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addressdocs/PLAN-v0.2.md:203 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressevals/test_proxy_chain.py:41 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Outbound HTTP to raw IP addressreferences/commands-windows.md:147 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addressevals/test_proxy_chain.py:40 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressdocs/PLAN-v0.2.md:188 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressreferences/commands-windows.md:146 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Outbound HTTP to raw IP addressscripts/proxy_chain.py:42 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Python subprocess execution detectedscripts/check_tools.py:118 · Python subprocess execution detected
AST05
HIGH
Outbound HTTP to raw IP addressscripts/proxy_chain.py:41 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addressevals/test_proxy_chain.py:66 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressreferences/commands-windows.md:160 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressdocs/PLAN-v0.2.md:186 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressevals/test_proxy_chain.py:39 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressreferences/commands-windows.md:153 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressreferences/commands-windows.md:154 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressscripts/proxy_chain.py:41 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressreferences/commands-windows.md:147 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Outbound HTTP to raw IP addressscripts/proxy_chain.py:40 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addressscripts/proxy_chain.py:42 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressscripts/proxy_chain.py:40 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
URL using raw IP addressdocs/PLAN-v0.2.md:202 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Outbound HTTP to raw IP addressreferences/commands-windows.md:160 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressreferences/commands-windows.md:153 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07