Skills/ClawHub/office-adobe-user-provision

office-adobe-user-provision@0.1.0

VERIFIED· install only

Publisher claims: "统一开通/管理 Microsoft 365(世纪互联)与 Adobe Creative Cloud 用户的自包含工具。创建、授权、重置密码、删除、查询、批量、自检,CLI/HTTP API 共用同一套 provider。USE WHEN 给XX开账号, 新建用户, 新增用户, 入职开账号, 开Office, 加O..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher eggyrooch-blip · publishing for 159 daysInstalls 574Last detonated 15 h ago
$clawhub install office-adobe-user-provision
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsapp/core/config.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesLoad configuration for all providers from .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 方式 A —— 自带 CLI(推荐手敲):oup 会自动定位 skill 目录、加载 .env,可从任意路径调用Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- ⚠️ **安全红线:`.env` 已被 `.gitignore` 排除。把本 skill 放进任何 git 仓库前,务必确认 `.env` 不会被 `git add`。绝不能 commit/push 到 GitHub。**Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据在本目录 `.env`** —— 已随包含真实生产配置(`CLIENT_SECRET` / `ADOBE_CLIENT_SECRET` / `SMTP_PASSWORD` / `DEFAULT_PASSWORD` 等)。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 凭据要换/轮换时,只改 `.env`,代码不动(`config.py` 是唯一读取处)。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsconfig.py:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 加载 .env 文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsconfig.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 加载 .env 文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsapp/providers/adobe/client.py:113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files默认域名从 .env 文件中的 ADOBE_DEFAULT_DOMAIN 配置读取。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,044 tok
1 file · 31 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.