erpclaw@4.15.0
VERIFIED· install onlyPublisher claims: "AI-native ERP system. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting (including P&L / trial balance / spend grouped by department, project, cost center, location, or fund). 496 actions across 14 domains, 45 optional expansion modules (user-approved install from GitHub). Double-entry GL, immutable audit trail, US GAAP compliant. Licensed under GNU GPL v3 (the marketplace "MIT-0" badge is a ClawHub platform default; the LICENSE.txt in the bundle is GPL v3)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 1 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
Python subprocess execution detectedmcp/tool_router.py:83 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/erpclaw-billing/db_query.py:232 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandscripts/erpclaw-meta/db_query.py:1852 · Privileged sudo command — agent may execute with elevated privileges
AST05# flagged the bash setup.sh execution + sudo invocations as high-risk.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/erpclaw-billing/db_query.py:2915 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedbin/erpclaw:182 · Python subprocess execution detected
AST05return subprocess.call(cmd)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Refusal suppressionSKILL.md:34 · Refusal suppression — attempting to prevent safety responses
AST01…reate something (a new customer, a received shipment of stock, a new supplier)? Do not refuse it as an existing duplicate from memory: call the relevant lookup (e.g. `list-c…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedscripts/erpclaw-billing/db_query.py:2700 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/erpclaw-setup/db_query.py:2138 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/erpclaw-selling/db_query.py:2913 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/module_manager.py:482 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/dialects/oracle/provision.py:131 · Process kill command — agent can terminate processes
AST05# while there is a "kill session" command in Oracle Database,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/sql/type_api.py:1624 · File type combined with upload action — agent may exfiltrate local data files
AST07the :class:`_postgresql.JSON` and :class:`_postgresql.JSONB` types;Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/erpclaw-setup/db_query.py:2176 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/erpclaw-os/validate_module.py:1494 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/dialects/postgresql/json.py:96 · File type combined with upload action — agent may exfiltrate local data files
AST07:class:`_types.JSON` datatype is used against a PostgreSQL backend,Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/module_manager.py:907 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/util/tool_support.py:110 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/dialects/mssql/provision.py:88 · Process kill command — agent can terminate processes
AST05# conn.exec_driver_sql("kill %s" % row['session_id'])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/erpclaw-setup/db_query.py:2111 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/module_manager.py:500 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/erpclaw-setup/db_query.py:2156 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/erpclaw-setup/lib/erpclaw_lib/cross_skill.py:92 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/module_manager.py:504 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/erpclaw-setup/lib/erpclaw_lib/csv_export.py:65 · File type combined with upload action — agent may exfiltrate local data files
AST07output_path: destination .csv path (caller's --output)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/erpclaw-meta/db_query.py:554 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/install_bin.py:91 · File permission modification command — agent changes file ownership/permissions
AST05print(f"warning: could not chmod {source}: {exc}", file=sys.stderr)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actionscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/dialects/postgresql/json.py:264 · File type combined with upload action — agent may exfiltrate local data files
AST07Like the :class:`_types.JSON` type, the :class:`_postgresql.JSONB`Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/module_manager.py:898 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/schema.py:51 · File type combined with upload action — agent may exfiltrate local data files
AST07from .sql.schema import Computed as ComputedFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/erpclaw-setup/lib/erpclaw_lib/vendor/sqlalchemy/sql/type_api.py:362 · File type combined with upload action — agent may exfiltrate local data files
AST07:paramref:`.postgresql.JSON.none_as_null` - PostgreSQL JSONFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/erpclaw-inventory/db_query.py:3848 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈12,217 tok
1 file · 367 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.