Skills/ClawHub/mapulse-korea

mapulse-korea@1.0.4

CAUTION· static only

Publisher claims: "한국주식 analyst Telegram bot. Monitors KOSPI/KOSDAQ, tracks watchlist, delivers AI briefings, answers natural-language questions in Korean/Chinese/English. Cove..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher lbtsm · publishing for 178 daysInstalls 1,063Last detonated 30 min ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 56/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Telegram Bot API URL; Telegram Bot API URL; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Telegram Bot API URLscripts/cron_day2_survey.py:110 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{TOKEN}/sendMessage",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Telegram Bot API URLscripts/cron_news_scan.py:53 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{TOKEN}/sendMessage",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsSKILL.md:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesAll configuration is via environment variables. No `.env` files are loaded automatically.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Telegram Bot API URLscripts/cron_daily_metrics.py:96 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{BOT_TOKEN}/sendMessage",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Telegram Bot API URLscripts/cron_briefing.py:35 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{TOKEN}/sendMessage",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Telegram Bot API URLscripts/cron_platform_push.py:80 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{TOKEN}/sendMessage",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsscripts/run_briefing.sh:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessource /home/admin/.openclaw/workspace/skills/mapulse-prod/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Telegram Bot API URLscripts/setup_channel.py:52 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{TOKEN}/sendMessage",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL shortener detectedscripts/chat_query.py:595 · URL shortener detected — destination cannot be verifiedf"https://is.gd/create.php?format=simple&url={requests.utils.quote(url)}",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Telegram Bot API URLscripts/setup_channel.py:25 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{TOKEN}/getChat",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Telegram Bot API URLscripts/cron_platform_push.py:97 · Telegram Bot API URL — data will be sent to Telegramf"https://api.telegram.org/bot{TOKEN}/sendMessage",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsscripts/setup_channel.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint(f"\n → 请将 CHANNEL_ID={channel_id} 写入 .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,387 tok
1 file · 38 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

24 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim lbtsm: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Telegram Bot API URL≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. URL shortener detected≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim lbtsmPropose a patch to the maintainer