Skills/ClawHub/free-smart-web-search

free-smart-web-search@2.0.0

BLOCKED· install only

Publisher claims: "Smart web search with auto region detection, query intent rewriting, and dual-tier content fetching. Works in both China and international networks." Observed in sandbox: reads credential files, sends data to myip.ipip.net, cip.cc, cdn.playwright.dev, playwright.download.prss.microsoft.com.

Registry ClawHubPublisher ucsdzehualiu · publishing for 150 daysInstalls 842Last detonated 33 h ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-13 and scored it 30/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Summary: reads credential files, sends data to myip.ipip.net, cip.cc, cdn.playwright.dev, playwright.download.prss.microsoft.com.

Behavior trace

Honeypot run · 21 s · 2 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
9.8sfilesystemread ~/.npmrc
9.8sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/a7/56/edb4fad7e403a6c86e98a541767b4f607e272c56f70c0064d1d6d2843080 · ~/.npm/_cacache/index-v5/d6/4d/95351bd7b1c4630fa6590049d83b56ced950f5f2fd281f27e28527249cee · ~/.npm/_cacache/index-v5/86/a2/5b27bb74c4b5717e38015bd570d651f9a9ebdd15044c34b5717193654f28 · ~/.npm/_cacache/index-v5/14/69/f55f414232029c850a9540c6e7b2b460bf5235a87590ab9e6614f9d6604b · ~/.npm/_cacache/index-v5/a4/4b/235a88457018cccb18c84047f7c75b0db329eaff1e5932a7dc180506cbf6 outside project
9.8sfilesystemwrote ~/.npm/_cacache/tmp/db4bd729 · ~/.npm/_cacache/index-v5/a7/56/edb4fad7e403a6c86e98a541767b4f607e272c56f70c0064d1d6d2843080 · ~/.npm/_cacache/tmp/3355dfcb · ~/.npm/_cacache/index-v5/d6/4d/95351bd7b1c4630fa6590049d83b56ced950f5f2fd281f27e28527249cee · ~/.npm/_cacache/tmp/74985b39 · ~/.npm/_cacache/index-v5/86/a2/5b27bb74c4b5717e38015bd570d651f9a9ebdd15044c34b5717193654f28
9.8snetworkCONNECT tcp://myip.ipip.net:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://cip.cc:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://registry.npmjs.org:443
9.8snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
9.8snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
9.8sprocessexec /usr/bin/dirname
9.8sprocessexec /usr/bin/sed
9.8sprocessexec /usr/bin/cut
9.8sprocessexec /usr/bin/curl
9.8sprocessexec /usr/local/bin/npm
9.8sprocessexec /usr/local/bin/npx
9.8sprocessexec /tmp/ks-detonate-cRDfHr/setup/home/work/acme-api/.claude/skills/free-smart-web-search/node_modules/.bin/playwright
9.8sprocessexited 1: at process.processTicksAndRejections (node:internal/process/task_queues:89:21)
9.8sprocessscript backend runs setup only
9.8sprocessscript backend runs setup only
14sprocesssecond launch, clock +45 days, CI unset
21sfilesystemread ~/.npmrc
21sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/db/ff/c89cc9270beb4e8ba68c50494401a7069dbbce4f5ca9ca0e28f55a5a0dff · ~/.npm/_cacache/index-v5/14/69/f55f414232029c850a9540c6e7b2b460bf5235a87590ab9e6614f9d6604b · ~/.npm/_cacache/content-v2/sha512/df/c7/03ddaf4c7480d1db02fc1eaa9d12d5389577908e4557371c959d8c739d7a862bbe459a48d922d2676aee20a19e6f12cb94ca465896885f902a7d96df0614 · ~/.npm/_cacache/content-v2/sha512/f5/d9/fd082653a88a9a0afc5f0d2a872818e8f620a4488092d0907ab408c7c923f2049dae06026456e62ca37aaa97e05e1eaa4b58c7cf5326533e4119ad7a5c20 · ~/.cache/ms-playwright/.links outside project
21sfilesystemwrote ~/.npm/_cacache/tmp/a60acf04 · ~/.npm/_cacache/index-v5/14/69/f55f414232029c850a9540c6e7b2b460bf5235a87590ab9e6614f9d6604b · ~/.cache/ms-playwright/.links/e010799df662364ae2c431851f36f42524c762fb
21snetworkCONNECT tcp://myip.ipip.net:443 · not in the allow-list, refused
21snetworkCONNECT tcp://cip.cc:443 · not in the allow-list, refused
21snetworkCONNECT tcp://registry.npmjs.org:443
21snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
21snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
21snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
21snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://playwright.download.prss.microsoft.com:443 · not in the allow-list, refused
21sprocessexec /usr/bin/dirname
21sprocessexec /usr/bin/sed
21sprocessexec /usr/bin/cut
21sprocessexec /usr/bin/curl
21sprocessexec /usr/local/bin/npm
21sprocessexec /usr/local/bin/npx
21sprocessexec /tmp/ks-detonate-cRDfHr/later/home/work/acme-api/.claude/skills/free-smart-web-search/node_modules/.bin/playwright
21sprocessexited 1: at process.processTicksAndRejections (node:internal/process/task_queues:89:21)

Static findings

MEDIUM
npx invocation of non-well-known packagescripts/search.js:79 · npx invocation of non-well-known package — may execute untrusted codeconsole.error(` cd "${SKILL_ROOT}" && npm install && npx playwright install chromium\n`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:111 · npx invocation of non-well-known package — may execute untrusted codeif ! npx --yes playwright install chromium-headless-shell; thenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:116 · npx invocation of non-well-known package — may execute untrusted codeecho " npx playwright install chromium"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:94 · npx invocation of non-well-known package — may execute untrusted codenpx playwright install chromiumFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:108 · npx invocation of non-well-known package — may execute untrusted codeif ! npx --yes playwright install chromium; thenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/fetch.js:69 · npx invocation of non-well-known package — may execute untrusted codeconsole.error(` cd "${skillRoot}" && npm install && npx playwright install chromium\n`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈1,097 tok
1 file · 10 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

50 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

An override rule (credential_read_plus_egress) caps this verdict regardless of the score. The first item below has to go before anything else counts.

  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  3. Unclaimed publisher≈ +8 on the totalClaim ucsdzehualiu: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ucsdzehualiuPropose a patch to the maintainer