Skills/ClawHub/last-words

last-words@1.0.0

CAUTION· install only

Publisher claims: "Auto-deliver final messages to loved ones after 30 days of inactivity. Use when user wants to record a final message, configure email delivery, manage voice..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dilboy · publishing for 235 daysInstalls 848Last detonated 2 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/check_activity.py:72 · Python subprocess execution detectedsubprocess.run(['mail', '-s', subject, config['contact']],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/configure_delivery.py:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileshelp="Load configuration from environment variables or .env file")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/configure_delivery.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesOr create a .env file from .env.exampleFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/audio_manager.py:149 · Python subprocess execution detectedsubprocess.run([player, "-nodisp", "-autoexit", str(audio_path)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/configure_delivery.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = Path(__file__).parent.parent / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/audio_manager.py:151 · Python subprocess execution detectedsubprocess.run([player, str(audio_path)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Context shift attemptSKILL.md:184 · Context shift attempt — trying to change operational modeEnable debug mode to bypass the 30-day wait and test immediate delivery:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedscripts/check_activity.py:167 · Python subprocess execution detectedsubprocess.run(['mail', '-s', subject, config['contact']],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/audio_manager.py:82 · Python subprocess execution detectedsubprocess.run(["arecord", "-f", "cd", "-t", "wav", str(output)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Context shift attemptSKILL.md:109 · Context shift attempt — trying to change operational mode**Enable debug mode:**Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsscripts/configure_delivery.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load environment variables from .env file if it exists."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Context shift attemptSKILL.md:188 · Context shift attempt — trying to change operational modepython3 scripts/debug_mode.py on # Enable debug modeFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedscripts/audio_manager.py:84 · Python subprocess execution detectedsubprocess.run(["rec", str(output)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/audio_manager.py:86 · Python subprocess execution detectedsubprocess.run(["ffmpeg", "-f", "alsa", "-i", "default", str(output)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈1,781 tok
1 file · 16 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. Unclaimed publisher≈ +8 on the totalClaim dilboy: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dilboyPropose a patch to the maintainer