Skills/ClawHub/internet-radio-music-db

internet-radio-music-db@2.6.3

CAUTION· static only

Publisher claims: "Internet radio music stream database — collect, store, and manage a database of music streams from internet-radio.com. ~150+ streams, 29 genres, auto-populat..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher dynamicsalex · publishing for 162 daysInstalls 1,351Last detonated 13 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-14 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: HTTP URL with a raw public IP address; HTTP URL with a raw public IP address; HTTP URL with a raw public IP address. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
HTTP URL with a raw public IP addressstate.json:2337 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"url": "http://209.236.126.18:8002/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
HTTP URL with a raw public IP addressstate.json:2657 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"url": "http://144.217.158.59:5120/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
HTTP URL with a raw public IP addressstate.json:2033 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"url": "http://195.22.100.60:8492/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
HTTP URL with a raw public IP addressstate.json:2456 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"url": "http://192.95.18.39:5784/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addressstate.json:2033 · URL using a raw public IP address — may bypass domain-based filtering"url": "http://195.22.100.60:8492/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addressstate.json:2657 · URL using a raw public IP address — may bypass domain-based filtering"url": "http://144.217.158.59:5120/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDstate.json:2357 · URL with suspicious TLD — commonly used for phishing/malware"url": "https://1000countryhits.stream.laut.fm/1000countryhits.m3u/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addressstate.json:2337 · URL using a raw public IP address — may bypass domain-based filtering"url": "http://209.236.126.18:8002/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDstate.json:2081 · URL with suspicious TLD — commonly used for phishing/malware"url": "https://1000italohits.stream.laut.fm/1000italohits.m3u/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addressstate.json:2456 · URL using a raw public IP address — may bypass domain-based filtering"url": "http://192.95.18.39:5784/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addressstate.json:2691 · URL using a raw public IP address — may bypass domain-based filtering"url": "http://94.23.85.189:8000/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDstate.json:2057 · URL with suspicious TLD — commonly used for phishing/malware"url": "https://forever80.stream.laut.fm/forever80.m3u/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Unicode escape sequence detectedscripts/build_db.py:126 · Unicode escape sequence detected — may contain obfuscated payloads…uage(name, genre): n = name.lower() for kw in ["\u0440\u0443\u0441", "\u0440\u043e\u0441\u0441\u0438\u044f", "\u043c\u043e\u0441\u043a\u0432\u0430", "\u0440\u0435\u0442\u0440\u043e", "\u…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
HTTP URL with a raw public IP addressstate.json:2691 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"url": "http://94.23.85.189:8000/listen.pls?sid=1/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDstate.json:2130 · URL with suspicious TLD — commonly used for phishing/malware"url": "https://100070er.stream.laut.fm/100070er.m3u/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDstate.json:2730 · URL with suspicious TLD — commonly used for phishing/malware"url": "https://1000indie.stream.laut.fm/1000indie.m3u/stream",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈2,098 tok
1 file · 8 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dynamicsalex: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. HTTP URL with a raw public IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  3. URL using a raw public IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. URL with suspicious TLD≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dynamicsalexPropose a patch to the maintainer