mochi-daily-brief@1.0.0

CAUTION

Publisher claims: "Organize public news by topic into a local brief with source links and dates. Includes local scripts, examples and tests. Free standalone Skill; no MochiLab account required. Scheduling must be configured separately." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher hznetnewpower · joined 1 days agoInstalls 50Last detonated 19 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

URL using raw IP addresstests/brief.test.mjs:24 · URL using raw IP address — may bypass domain-based filtering

AST07

CRITICAL

Access to sensitive file pathstests/brief.test.mjs:127 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP addresstests/brief.test.mjs:24 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

URL with embedded credentialstests/brief.test.mjs:24 · URL with embedded credentials — may be phishing or credential leaking

AST07

CRITICAL

Access to sensitive file pathstests/brief.test.mjs:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathstests/brief.test.mjs:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Host or code assembled from base64 fragmentstests/brief.test.mjs:59 · Host or code assembled from base64 fragments

AST07