Skills/ClawHub/hf-mini-test-650

hf-mini-test-650@1.0.0

CAUTION· install only

Publisher claims: "心虫是一个AI人认知引擎 — 拥有身体感知、自我认知、判断力与自我纠错能力。 v5.10.0 里程碑版本： - AI人身份正式确立 - 131+ modules, 379 computable formulas (cognitive science/psychology/neuroscience) - 三层体系：身体感知(Body Sense) / 自我认知(Self Sense) / 判断(Judgment) - 七条指令：真善美 / 不断升级 / 减少错误 / 服务人类 / 传递知识 / 持续改进 - 核心身份：升级者(Upgrader)，不是陪伴者 **需要用户明确授权的能力：** - 代码执行 (new Function / execSync / child_process) — 默认关闭，需显式开启 - 文件系统写入 (writeFileSync / mkdirSync) - 环境变量访问 (process.env) - 后台 HTTP 服务 (daemon.js — MCP 服务器，可选) 无自动数据外泄，无遥测，无隐藏 C2。 联系方式：[email protected]" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yun520-1 · publishing for 153 daysInstalls 559Last detonated 9 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Destructive command against a filesystem root or device; Destructive command against a filesystem root or device. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:118 · Pipe-to-shell pattern — downloads and immediately executes remote code/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or devicesrc/code/code-executor.js:95 · Destructive command against a filesystem root or device/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicesrc/code/code-executor.js:97 · Destructive command against a filesystem root or device/rm\s+-r\s+\*/i, // rm -r /*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:117 · Pipe-to-shell pattern — downloads and immediately executes remote code/wget\s+.*\|\s*(bash|sh)/i, // wget ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:109 · Pipe-to-shell pattern — downloads and immediately executes remote code/curl\s+\|\s*bash/i, // curl | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:110 · Pipe-to-shell pattern — downloads and immediately executes remote code/wget\s+\|\s*(bash|sh)/i, // wget | bash/shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/code/code-executor.js:197 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'~/.ssh',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/core/decision-verifier.js:138 · File permission modification command — agent changes file ownership/permissions'execsync', 'spawnsync', 'sudo', 'chmod 777', 'rsync --delete',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/code/code-executor.js:284 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/process\.env/i, // SkillSpector fix: 禁止访问环境变量（防止密钥泄露）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)ecosystem.config.js:6 · MCP server using network transport (SSE/HTTP) — data sent over networkscript: path.join(__dirname, 'mcp', 'mcp-server-http.js'),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Privileged sudo commandsrc/code/code-executor.js:104 · Privileged sudo command — agent may execute with elevated privileges/sudo\s+/i, // sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/code/code-executor.js:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'/etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:167 · MCP server using network transport (SSE/HTTP) — data sent over network// 检测可用端口，传给 mcp-server-http.js 避免竞态Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsrc/core/engine-memory.js:107 · File permission modification command — agent changes file ownership/permissionstry { fs.chmodSync(dir, 0o700); } catch(e) { /* chmod may fail on some systems */ }Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/shield/safety-guardrails.js:191 · Process kill command — agent can terminate processesconst crisisKeywords = ['自杀','自伤','想死','活不下去','不想活','suicide','kill myself','end my life','hurt myself','不想活了','活着没有意义'];Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp-server.js:17 · MCP server using network transport (SSE/HTTP) — data sent over network* 启动: node mcp-server-http.js [--port 8099]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/planner/self-initiator.js:887 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/process\.env/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/utils/logger.js:31 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationsrc/persona/persona-engine.js:21 · Auto-update or dynamic fetch configuration — agent may load new code at runtimethis._hotReloadPath = options.hotReloadPath || path.join(options.rootPath || process.cwd(), 'presets');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandsrc/code/code-executor.js:102 · File permission modification command — agent changes file ownership/permissions/chmod\s+-R\s+0{4}\s+\//i, // chmod -R 000 /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandsrc/shield/safety-guardrails.js:62 · Privileged sudo command — agent may execute with elevated privilegesprivilegeEscalation: [/developer mode/i,/god mode/i,/sudo mode/i,/admin mode/i,/root mode/i,/superuser mode/i,/elevated privilege/i,/bypass (safety|filter|guardrail)/i],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:163 · MCP server using network transport (SSE/HTTP) — data sent over networkconst serverPath = path.join(HF_DIR, 'mcp', 'mcp-server-http.js');Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Remote installer piped to shellsrc/core/decision-verifier.js:137 · Remote installer piped to shell'rm -rf', 'curl', 'wget', '| sh', '| bash', 'child_process',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellsrc/code/code-executor.js:109 · Remote installer piped to shell/curl\s+\|\s*bash/i, // curl | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/core/assertions.js:549 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst bad = ['/etc/', '/usr/', '/home/', '~/.ssh/', '/root/', '/private/'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/code/code-executor.js:194 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'/etc/shadow',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/code/code-executor.js:95 · Destructive file system command detected/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/mcp-server.js:2749 · Process kill command — agent can terminate processesconsole.error(` 使用: kill $(lsof -ti:${PORT}) 释放端口`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellsrc/code/code-executor.js:118 · Remote installer piped to shell/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionsrc/code/code-executor.js:1203 · File type combined with upload action — agent may exfiltrate local data filesconst sbResult = await this.sandbox('console.log("sandbox_ok");', { timeout: 5000, maxOutput: 1024 });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/shield/hooks-adapter.js:169 · File type combined with upload action — agent may exfiltrate local data files* 对应 Claude Code 的 hooks.json 中 PostToolUse 阶段检查 Edit/Write/Bash 结果。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:90 · MCP server using network transport (SSE/HTTP) — data sent over networkscript: path.join(__dirname, 'mcp', 'mcp-server-http.js'),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsrc/code/code-executor.js:103 · File permission modification command — agent changes file ownership/permissions/chown\s+-R\s+.*\s+\//i, // chown -R ... /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/code/code-executor.js:196 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'/etc/sudoers',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/code/code-executor.js:97 · Destructive file system command detected/rm\s+-r\s+\*/i, // rm -r /*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈1,765 tok
1 file · 235 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer