learnings@1.3.0
CAUTION· static onlyPublisher claims: "Continuous learning from failures, corrections, and patterns. Logs mistakes to prevent repetition. Own MeiliSearch index. Learns version rules, approach pref..." Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyt+CategoryObserved action
This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
MEDIUM
Python subprocess execution detectedscripts/search_learnings.sh:49 · Python subprocess execution detected
AST05result = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/search_learnings.sh:24 · File permission modification command — agent changes file ownership/permissions
AST05chmod 600 "$QUERY_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedscripts/auto_extract.sh:158 · Python subprocess execution detected
AST05subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandSKILL.md:15 · File permission modification command — agent changes file ownership/permissions
AST05- **Secure temp files**: All temp files use `mktemp` with `chmod 600` and are cleaned up on exitFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedscripts/log_learning.sh:69 · Python subprocess execution detected
AST05sr = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsSKILL.md:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- **Credentials**: MeiliSearch key is loaded from `~/.openclaw/workspace/.env` — never hardcoded in scriptsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathslib/config.sh:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ENV_FILE="${WORKSPACE}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Requires `~/.openclaw/workspace/.env`:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedscripts/distill_learnings.sh:51 · Python subprocess execution detected
AST05result = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/log_learning.sh:43 · File permission modification command — agent changes file ownership/permissions
AST05chmod 600 "$DOC_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathslib/config.sh:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .env if it existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandscripts/distill_learnings.sh:30 · File permission modification command — agent changes file ownership/permissions
AST05chmod 600 "$QUERY_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedscripts/log_learning.sh:87 · Python subprocess execution detected
AST05r = subprocess.run([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈868 tok
1 file · 10 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim enjuguna: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim enjugunaPropose a patch to the maintainer