Skills/ClawHub/js-eyes

js-eyes@2.10.0

CAUTION· install only

Publisher claims: "Install, connect, operate, and troubleshoot the host-neutral JS Eyes browser and Skill Runtime from CLI, MCP, or the optional OpenClaw adapter." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher imjszhang · publishing for 147 daysInstalls 3,853Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Auto-update or dynamic fetch configuration; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathspackages/protocol/skill-runner.js:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, JS_EYES_SKILL_DIR: skillDir },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationpackages/server-core/index.js:75 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst hotReloadConfig = options.hotReloadConfig !== false;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patternopenclaw-plugin/actions/skills.mjs:77 · Pipe-to-shell pattern — downloads and immediately executes remote codelines.push(` 或命令行: curl -fsSL https://js-eyes.com/install.sh | bash -s -- ${s.id}`);Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Auto-update or dynamic fetch configurationpackages/server-core/index.js:25 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst { loadConfig, resolveHotReloadableSecurity } = tryLoadConfigModule();Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationpackages/skill-runtime/tests/registry.test.js:207 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeit('refreshes dispatcher description/parameters on hot-reload when contract changes', async () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shellopenclaw-plugin/actions/skills.mjs:77 · Remote installer piped to shelllines.push(` 或命令行: curl -fsSL https://js-eyes.com/install.sh | bash -s -- ${s.id}`);Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Auto-update or dynamic fetch configurationpackages/server-core/tests/security-hot-reload.test.js:212 · Auto-update or dynamic fetch configuration — agent may load new code at runtimehotReloadConfig: false,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationpackages/server-core/tests/security-hot-reload.test.js:239 · Auto-update or dynamic fetch configuration — agent may load new code at runtimehotReloadConfig: false,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandpackages/server-core/index.js:111 · File permission modification command — agent changes file ownership/permissionslogger.info?.(`[js-eyes-server] Generated new server token at ${tokenFilePath} (chmod 600)`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Auto-update or dynamic fetch configurationpackages/server-core/tests/auth.test.js:44 · Auto-update or dynamic fetch configuration — agent may load new code at runtimehotReloadConfig: false,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationpackages/server-core/tests/security-hot-reload.test.js:73 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeassert.ok(!HOT_RELOADABLE_SECURITY_KEYS.includes('allowAnonymous'));Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationpackages/server-core/tests/security-hot-reload.test.js:174 · Auto-update or dynamic fetch configuration — agent may load new code at runtimehotReloadConfig: false,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationpackages/server-core/index.js:456 · Auto-update or dynamic fetch configuration — agent may load new code at runtime`[js-eyes-server] security reload: 0 hot-reloadable fields changed, but ${ignoredKeys.length} non-hot field(s) require restart: [${ignoredKeys.join(',')}] (source=${source})`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationpackages/skill-runtime/tests/registry.test.js:236 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// so we exercise the hot-reload refresh path (not a new-name registration).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationpackages/server-core/index.js:491 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (!hotReloadConfig) return;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈2,486 tok
1 file · 89 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim imjszhang: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim imjszhangPropose a patch to the maintainer