Skills/ClawHub/line-oa-chat-send

line-oa-chat-send@0.1.6

CAUTION· install only

Publisher claims: "Send explicitly authorized LINE Official Account Chat messages through a persistent Chromium session; user-operated LINE login or reauthentication may use a temporary remote noVNC handoff that grants interactive browser control." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher mosluce · publishing for 110 daysInstalls 1,170Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Tunneling service URL; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandcontainers/Dockerfile:47 · File permission modification command — agent changes file ownership/permissions&& chmod 700 "$LINE_OA_SEND_CHAT_RUNTIME_DIR" "$LINE_OA_SEND_CHAT_CHROMIUM_PROFILE" \Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Destructive file system command detectedcontainers/Dockerfile:93 · Destructive file system command detectedrm -f /tmp/uv /tmp/setup_line_oa_runtime.shFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedcontainers/Dockerfile:75 · Destructive file system command detectedrm -rf /var/lib/apt/lists/*; \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/lib/caddy.sh:28 · File permission modification command — agent changes file ownership/permissionschmod 600 "$config"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Destructive file system command detectedcontainers/Dockerfile:30 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandcontainers/Dockerfile:91 · File permission modification command — agent changes file ownership/permissionschown -R lineoa:lineoa "$LINE_OA_SEND_CHAT_RUNTIME_DIR"; \Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Privileged sudo commandcontainers/test/default.sh:207 · Privileged sudo command — agent may execute with elevated privilegesgrep -qE "^[[:space:]]*(→ )?sudo " <<<"$out" && { echo "$v invokes sudo"; exit 1; }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandcontainers/test/tunnel.sh:62 · Process kill command — agent can terminate processeskill -0 \"\$chromium_pid\" 2>/dev/null && ok 'session uninterrupted by arming' || bad 'session uninterrupted by arming'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/start_line_oa_vnc_handoff.sh:61 · Privileged sudo command — agent may execute with elevated privilegesprintf 'Install commands (run by an identity with host package permission; no sudo is invoked by this skill):\n' >&2Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Tunneling service URLscripts/start_line_oa_vnc_handoff.sh:115 · Tunneling service URL — may route traffic to attacker infrastructureurl="$(grep -Eo 'https://[-a-z0-9]+\.trycloudflare\.com' "$tunnel_log" | head -1 || true)"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Privileged sudo commandcontainers/test/default.sh:161 · Privileged sudo command — agent may execute with elevated privilegesgrep -qE "^[[:space:]]*sudo " <<<"$out" && { echo "instructions invoke sudo"; exit 1; }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandcontainers/test/tunnel.sh:87 · Process kill command — agent can terminate processeskill -0 \"\$chromium_pid\" 2>/dev/null && ok 'Chromium still running after revoke' || bad 'Chromium still running after revoke'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/lib/caddy.sh:18 · File permission modification command — agent changes file ownership/permissionschmod 600 "$config"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandcontainers/test/default.sh:96 · Process kill command — agent can terminate processeskill -KILL "$pid" 2>/dev/null || true # hard kill leaves SingletonLock behindFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/start_line_oa_chromium.sh:90 · Privileged sudo command — agent may execute with elevated privilegesprintf 'Install commands (run by an identity with host package permission; no sudo is invoked by this skill):\n' >&2Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandcontainers/Dockerfile:48 · File permission modification command — agent changes file ownership/permissions&& chown lineoa:lineoa "$LINE_OA_SEND_CHAT_RUNTIME_DIR" "$LINE_OA_SEND_CHAT_CHROMIUM_PROFILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandcontainers/Dockerfile:51 · File permission modification command — agent changes file ownership/permissionsRUN chmod 755 /usr/local/bin/line-oa-entrypointFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/start_line_oa_chromium.sh:197 · Process kill command — agent can terminate processeskill -0 "$chromium_pid" 2>/dev/null || breakFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/start_line_oa_chromium.sh:201 · Process kill command — agent can terminate processeskill "$chromium_pid" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/start_line_oa_vnc_handoff.sh:171 · Process kill command — agent can terminate processeskill -0 "$tunnel_pid" 2>/dev/null || fail_phase url_verified "cloudflared exited during verification; see $tunnel_log"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/setup_line_oa_runtime.sh:40 · File permission modification command — agent changes file ownership/permissionschmod 700 "$runtime_dir"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_chromium.sh:56 · Process kill command — agent can terminate processesif [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_vnc_handoff.sh:36 · Process kill command — agent can terminate processeskill -0 "$tunnel_pid" 2>/dev/null && kill -KILL "$tunnel_pid" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/start_line_oa_vnc_handoff.sh:96 · File permission modification command — agent changes file ownership/permissionschmod 600 "$tunnel_log"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/lib/session.sh:111 · Process kill command — agent can terminate processes[[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_vnc_handoff.sh:33 · Process kill command — agent can terminate processeskill -0 "$tunnel_pid" 2>/dev/null || breakFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/start_line_oa_chromium.sh:202 · Process kill command — agent can terminate processes(( owns_display )) && kill "$xvfb_pid" 2>/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_chromium.sh:39 · Process kill command — agent can terminate processeskill -TERM "$chromium_pid" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/setup_line_oa_runtime.sh:47 · File permission modification command — agent changes file ownership/permissionschmod 700 "$browser_dir"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/lib/ports.sh:59 · Process kill command — agent can terminate processes# `sleep .2` plus `kill -0` only proved the process existed, which is bothFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_chromium.sh:57 · Process kill command — agent can terminate processeskill -TERM "$pid" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/lib/session.sh:25 · File permission modification command — agent changes file ownership/permissionschmod 700 "$dir"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/start_line_oa_vnc_handoff.sh:117 · Process kill command — agent can terminate processeskill -0 "$tunnel_pid" 2>/dev/null || fail_phase tunnel_url "cloudflared exited before emitting a URL; see $tunnel_log"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/start_line_oa_vnc_handoff.sh:154 · Process kill command — agent can terminate processeskill -0 "$tunnel_pid" 2>/dev/null || fail_phase dns_resolved "cloudflared exited before its hostname resolved; see $tunnel_log"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/lib/phase_timing.sh:34 · File permission modification command — agent changes file ownership/permissionschmod 600 "$__phase_log"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_chromium.sh:41 · Process kill command — agent can terminate processeswhile kill -0 "$chromium_pid" 2>/dev/null; doFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/start_line_oa_chromium.sh:171 · File permission modification command — agent changes file ownership/permissionschown -R lineoa:lineoa $profile_dirFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_vnc_handoff.sh:31 · Process kill command — agent can terminate processeskill -TERM "$tunnel_pid" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/start_line_oa_chromium.sh:99 · File permission modification command — agent changes file ownership/permissionschmod 700 -- "$profile_dir"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/start_line_oa_chromium.sh:113 · Process kill command — agent can terminate processesif [[ "$lock_host" == "$(hostname)" && "$lock_pid" =~ ^[0-9]+$ ]] && ! kill -0 "$lock_pid" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/start_line_oa_vnc_handoff.sh:104 · File permission modification command — agent changes file ownership/permissions: > "$file"; chmod 600 "$file"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/setup_line_oa_runtime.sh:43 · File permission modification command — agent changes file ownership/permissionschmod 700 "$runtime_dir/venv"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_chromium.sh:37 · Process kill command — agent can terminate processesif [[ -n "$chromium_pid" ]] && kill -0 "$chromium_pid" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/lib/session.sh:27 · File permission modification command — agent changes file ownership/permissionschmod 600 "$state"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/stop_line_oa_vnc_handoff.sh:30 · Process kill command — agent can terminate processesif [[ -n "$tunnel_pid" ]] && kill -0 "$tunnel_pid" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/lib/phase_timing.sh:31 · File permission modification command — agent changes file ownership/permissionschmod 700 "$runtime_dir" "$__phase_dir" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/start_line_oa_chromium.sh:136 · File permission modification command — agent changes file ownership/permissionschmod 700 "$runtime_dir" "$runtime_dir/logs"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈1,545 tok
1 file · 30 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim mosluce: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Tunneling service URL≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  3. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  4. Destructive file system command detected≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Privileged sudo command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim moslucePropose a patch to the maintainer