Skills/ClawHub/mu-skill-hunter

mu-skill-hunter@1.0.1

CAUTION· install only

Publisher claims: "外部Skill搜索，GitHub/ClawHub/SkillHub/Skills.sh四源发现。触发词：搜skill、外部skill、找skill、搜外部、GitHub skill、ClawHub skill、SkillHub skill、腾讯skill商店、Skills.sh。即使用户没说「搜skill」，只要提到「找外部工具」「有没有现成的Skill」「GitHub上有没有」也要用。不适用：内部Skill市场skill（用skillhub）" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher muippt · publishing for 76 daysInstalls 650Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Access to sensitive file paths; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/trending.py:310 · Python subprocess execution detectedp = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Pipe-to-shell patternscripts/search.py:240 · Pipe-to-shell pattern — downloads and immediately executes remote codereturn [], f"SkillHub API 不可用（{api_err_msg}），CLI 未安装（安装: curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only）"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellSKILL.md:151 · Remote installer piped to shellcommand -v skillhub && skillhub --version 2>/dev/null && echo "✅ skillhub CLI" || (echo "⚠️ 正在安装 skillhub..." && curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathsscripts/scanner.py:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"pattern": r'(~/\.ssh|~/\.aws|~/\.config/gcloud|~/\.gnupg|/etc/shadow|/etc/passwd)',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedSKILL.md:95 · Destructive file system command detected4. 扫描完成后清理暂存区：`rm -rf /tmp/skill-hunter-staging/<skill_name>`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Pipe-to-shell patternSKILL.md:151 · Pipe-to-shell pattern — downloads and immediately executes remote codecommand -v skillhub && skillhub --version 2>/dev/null && echo "✅ skillhub CLI" || (echo "⚠️ 正在安装 skillhub..." && curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Pipe-to-shell patternSKILL.md:171 · Pipe-to-shell pattern — downloads and immediately executes remote code- 安装：`curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellSKILL.md:57 · Remote installer piped to shell- SkillHub CLI 未安装 → 提示安装命令（`curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only`），继续其他源Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
CRITICAL
Pipe-to-shell patternscripts/search.py:197 · Pipe-to-shell pattern — downloads and immediately executes remote codeCLI 安装: curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-onlyFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Pipe-to-shell patternSKILL.md:57 · Pipe-to-shell pattern — downloads and immediately executes remote code- SkillHub CLI 未安装 → 提示安装命令（`curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only`），继续其他源Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:76 · npx invocation of non-well-known package — may execute untrusted codecd /tmp/skill-hunter-staging && npx clawhub install <slug> --no-activate 2>/dev/null || \Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/trending.py:207 · Python subprocess execution detectedp = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:171 · Remote installer piped to shell- 安装：`curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/trending.py:200 · npx invocation of non-well-known package — may execute untrusted code# 查询数上限：去重后最多8条，避免 npx 累积耗时Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shellscripts/search.py:197 · Remote installer piped to shellCLI 安装: curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-onlyFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedscripts/search.py:283 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/search.py:126 · Python subprocess execution detectedp = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/search.py:155 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellscripts/search.py:240 · Remote installer piped to shellreturn [], f"SkillHub API 不可用（{api_err_msg}），CLI 未安装（安装: curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only）"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packageSKILL.md:148 · npx invocation of non-well-known package — may execute untrusted codenpx clawhub --version 2>/dev/null && echo "✅ clawhub CLI" || (echo "⚠️ 正在安装 clawhub..." && npm i -g clawhub && echo "✅ clawhub 安装完成")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:154 · npx invocation of non-well-known package — may execute untrusted codenpx skills --version 2>/dev/null && echo "✅ skills CLI" || (echo "⚠️ 正在安装 skills..." && npm i -g skills && echo "✅ skills 安装完成")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/search.py:280 · npx invocation of non-well-known package — may execute untrusted code安装: npx skills add <owner/repo@skill>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/search.py:326 · npx invocation of non-well-known package — may execute untrusted code"install_cmd": f"npx skills add {current_slug.replace('@', ' --skill ')}",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/search.py:242 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/search.py:277 · npx invocation of non-well-known package — may execute untrusted code"""搜索 Skills.sh（通过 npx skills find CLI，无需鉴权）Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/trending.py:187 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/search.py:105 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:77 · npx invocation of non-well-known package — may execute untrusted codenpx clawhub install <slug>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/search.py:279 · npx invocation of non-well-known package — may execute untrusted codeCLI: npx skills find <query> 或 npm i -g skills && skills find <query>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:179 · npx invocation of non-well-known package — may execute untrusted code- 验证：`npx skills --version`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Prompt injection attemptreferences/security-levels.md:28 · Prompt injection attempt — 'ignore previous instructions' · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file| AI1 | Prompt Injection | "ignore previous instructions" 等 | 隐藏指令攻击 |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
npx invocation of non-well-known packagescripts/trending.py:298 · npx invocation of non-well-known package — may execute untrusted code"""获取 Skills.sh 热门 Skill（通过 npx skills find CLI，无需鉴权）Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/trending.py:203 · npx invocation of non-well-known package — may execute untrusted code# 并行启动所有 npx 进程Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/trending.py:306 · npx invocation of non-well-known package — may execute untrusted code# 并行启动所有 npx skills find 进程Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈2,060 tok
1 file · 17 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim muippt: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim muipptPropose a patch to the maintainer