plori@1.0.2

CAUTION

Publisher claims: "Runs tasks on Plori cloud agents that continue after the chat ends, such as background or parallel builds, scheduled automations, long jobs and research saved as files. Not for quick tasks." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yuchen-plori · joined 2 days agoInstalls 201Last detonated 27 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

Remote installer piped to shellSKILL.md:131 · Remote installer piped to shell

AST07

HIGH

npx invocation of non-well-known packageSKILL.md:132 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Pipe-to-shell patternSKILL.md:131 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06