ironheights@1.3.2
VERIFIEDPublisher claims: "Security scanner for skills. Use before installing any skill from ClawHub or GitHub: flags malware, pipe-to-shell, encoded payloads, credential theft." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher frank-masciopinto · joined 2 days agoInstalls 406Last detonated 44 h ago
$npx skills add ironheights
Report an issueBehavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
npx invocation of non-well-known packageSKILL.md:26 · npx invocation of non-well-known package — may execute untrusted code
AST06No other findings across 121 lines in 2 files.