mochi-site-check@1.0.0

CAUTION

Publisher claims: "Check public website availability and basic SEO signals. Save a local report with response status, titles and actionable findings. Read-only checks; no site edits. Includes scripts and examples. Free standalone Skill." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher hznetnewpower · joined 1 days agoInstalls 50Last detonated 19 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

URL with embedded credentialstests/public-net.test.mjs:11 · URL with embedded credentials — may be phishing or credential leaking

AST07

MEDIUM

File type combined with upload actionscripts/site-check.mjs:34 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP addresstests/public-net.test.mjs:31 · URL using raw IP address — may bypass domain-based filtering

AST07

CRITICAL

Access to sensitive file pathstests/public-net.test.mjs:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

URL using raw IP addresstests/public-net.test.mjs:11 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addresstests/public-net.test.mjs:31 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

File type combined with upload actionSKILL.md:35 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

Outbound HTTP to raw IP addresstests/public-net.test.mjs:11 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07