Skills/ClawHub/platform-compliance

platform-compliance@1.0.24

CAUTION

Publisher claims: "上架前平台合规校验与自动修复。待上架图 → Amazon / TikTok Shop / Temu / Shopee / 淘宝各平台的通过或驳回风险报告，可一键修成合规图。当用户说「会不会被驳回」「合规检查」「白底不达标」「主图规格」「传上去被拒」时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dlazyai · joined 2 days agoInstalls 1,602Last detonated 41 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packagereferences/provider-cli.md:68 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsscripts/gen.mjs:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Fake instruction boundary tagreferences/provider-cli.md:130 · Fake instruction boundary tag

AST01

HIGH

npx invocation of non-well-known packagescripts/brand.mjs:97 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsscripts/lib/providers.mjs:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05