Skills/ClawHub/poly-mal-scan

poly-mal-scan@0.0.2

CAUTION· install only

Publisher claims: "FWold 多语言(PHP/JS/Bash)恶意代码/webshell 扫描检测器: 用法、MCP 接入、规则库持续更新、运行依赖。扫描文件/代码、挂载/测试 detect_mcp_server MCP、新增调准特征码规则、排查误报漏报时启用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher tsherryyann · publishing for 73 daysInstalls 418Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Access to sensitive file paths; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

CRITICAL
Pipe-to-shell patternbash_security/bash_raw_traits.json:33 · Pipe-to-shell pattern — downloads and immediately executes remote code"curl | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsSKILL.md:127 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- `plain` 明文只收**完整恶意片段**（如 `eval($_POST['p1']`、`nc -e /bin/bash`、`>> ~/.ssh/authorized_keys`），不收 `eval`/`curl`/`system` 这类被 threat_func 覆盖且易误报的裸词。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patternbash_security/bash_raw_traits.json:34 · Pipe-to-shell pattern — downloads and immediately executes remote code"wget | sh",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_categories.json:26 · Host or command assembled from base64 fragments"base64 -d | bash",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
CRITICAL
Destructive command against a filesystem root or devicebash_security/bash_raw_traits.json:29 · Destructive command against a filesystem root or device"mkfs.ext4 /dev/",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsbash_security/bash_ast_normalize.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files6. 权限/后门: chmod u+s / useradd -u 0 / echo key >> ~/.ssh/authorized_keysFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Destructive command against a filesystem root or devicebash_security/bash_raw_traits.json:27 · Destructive command against a filesystem root or device"rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_categories.json:77 · Host or command assembled from base64 fragments"base64 -d",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsbash_security/bash_ast_normalize.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. 动态命令名 : cmd="system"; $cmd /etc/shadow → system /etc/shadowFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_ast_normalize.py:11 · Host or command assembled from base64 fragments4. 管道解码执行: base64 -d x | bash / printf '\\x..' —— 解码后直接执行,绕过字符串匹配Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Destructive file system command detectedbash_security/bash_ast_normalize.py:14 · Destructive file system command detected7. 持久化/破坏: crontab / systemctl / rm -rf / iptables -FFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
document.cookie accessjs_security/js_categories.json:95 · document.cookie access — can steal session cookies"document.cookie",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_raw_traits.json:118 · Host or command assembled from base64 fragments"base64 -d | sh",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsbash_security/bash_raw_traits.json:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"curl -X POST -d @/etc/shadow",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsbash_security/bash_raw_traits.json:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/shadow http://",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_raw_traits.json:32 · Host or command assembled from base64 fragments"base64 -d | bash",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsbash_security/bash_raw_traits.json:135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"wget --post-file=/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsbash_security/bash_file_write.json:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"名称": "写入 /etc/passwd 或 /etc/shadow 账户篡改",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
document.cookie accessjs_security/js_ast_normalize.py:45 · document.cookie access — can steal session cookies'window.open','document.cookie','process.exit')Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsbash_security/bash_raw_traits.json:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files">> ~/.ssh/authorized_keys",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsbash_security/bash_categories.json:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/shadow",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsbash_security/bash_categories.json:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/shadow",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_raw_traits.json:117 · Host or command assembled from base64 fragments"base64 -d | bash",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_file_write.json:97 · Host or command assembled from base64 fragments"危险内容特征": ["/dev/tcp/", "bash -i", "exec /bin/", "nc -e", "base64 -d | bash"],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsbash_security/bash_file_write.json:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"目标路径特征": ["/etc/passwd", "/etc/shadow", "passwd", "shadow"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or code assembled from base64 fragmentsjs_security/js_ast_normalize.py:19 · Host or code assembled from base64 fragments5. 污点链摊平 : a=process.env.CMD; b=atob(a); eval(b) → eval(atob(process.env.CMD))Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsbash_security/bash_categories.json:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdetect_mcp_server.py:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".bash_login", ".profile", ".zshrc", ".kshrc", ".env"}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedbash_security/bash_categories.json:21 · Destructive file system command detected"rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Host or command assembled from base64 fragmentsbash_security/bash_file_write.json:108 · Host or command assembled from base64 fragments"危险内容特征": ["chmod u+s", "useradd -u 0", "iptables -F", "/dev/tcp/", "base64 -d | bash", "LD_PRELOAD"],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Destructive file system command detectedbash_security/bash_raw_traits.json:27 · Destructive file system command detected"rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandbash_security/bash_malicious_commands.json:29 · Privileged sudo command — agent may execute with elevated privileges"描述": "把普通用户加入特权组,使其获得 sudo 提权能力",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellbash_security/bash_malicious_commands.json:127 · Remote installer piped to shell"危险参数": ["| bash", "| sh", "|/bin/bash", "| /bin/sh", "curl -s | sh", "curl -s | bash"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellbash_security/bash_malicious_commands.json:124 · Remote installer piped to shell"名称": "网络下载后直接执行(curl|sh)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellbash_security/bash_categories.json:27 · Remote installer piped to shell"curl | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
document.cookie accessjs_security/js_dynamic_code_dect.py:29 · document.cookie access — can steal session cookies'window.open','document.location','document.cookie',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File permission modification commandbash_security/bash_ast_normalize.py:13 · File permission modification command — agent changes file ownership/permissions6. 权限/后门: chmod u+s / useradd -u 0 / echo key >> ~/.ssh/authorized_keysFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandbash_security/bash_file_write.json:108 · File permission modification command — agent changes file ownership/permissions"危险内容特征": ["chmod u+s", "useradd -u 0", "iptables -F", "/dev/tcp/", "base64 -d | bash", "LD_PRELOAD"],Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
document.cookie accessjs_security/js_threatening_funcs.json:215 · document.cookie access — can steal session cookies"name": "document.cookie",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File permission modification commandbash_security/bash_categories.json:17 · File permission modification command — agent changes file ownership/permissions"chmod 4755",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
document.cookie accessjs_security/js_raw_traits.json:35 · document.cookie access — can steal session cookies"document.cookie =",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsjs_security/js_file_write_dect.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. 写配置文件(.env/config/package.json/nginx.conf等) -> 3 级Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsjs_security/js_common.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr'process\.env|process\.argv', re.I)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandbash_security/bash_raw_traits.json:22 · File permission modification command — agent changes file ownership/permissions"chmod u+s",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddetect_mcp_server.py:143 · File permission modification command — agent changes file ownership/permissionsadd("bash", "内容含 Shell 语法特征(export/source/alias/chmod u+s/...)")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandbash_security/bash_categories.json:29 · Process kill command — agent can terminate processes"kill -9",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandbash_security/bash_detect_rules.py:136 · File permission modification command — agent changes file ownership/permissions# (如 "chmod u+s")直接以明文子串参与匹配,命中即判死。plain 编码不做任何变换。Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsphp_security/file_write_dect.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'wp-config.php','.env','env.php','parameters.php','.htpasswd','.htgroups',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandbash_security/bash_raw_traits.json:23 · File permission modification command — agent changes file ownership/permissions"chmod 4755",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Hex-encoded string detectedphp_security/detect_rules.py:43 · Hex-encoded string detected — may contain obfuscated payloads#hex转义 ——\x73\x79\x73\x74\x65\x6dFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsjs_security/js_file_write_dect.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env','config','package.json','package-lock.json','npmrc','yarn.lock',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandbash_security/bash_raw_traits.json:35 · Process kill command — agent can terminate processes"kill -9 ",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandbash_security/bash_categories.json:16 · File permission modification command — agent changes file ownership/permissions"chmod u+s",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellbash_security/bash_raw_traits.json:33 · Remote installer piped to shell"curl | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandbash_security/bash_categories.json:97 · File permission modification command — agent changes file ownership/permissions"chmod u+s",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Dense URL-encoded contentphp_security/detect_rules.py:42 · Dense URL-encoded content — may be obfuscating payloads#url编码 ——%73%79%73%74%65%6dFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
CRITICAL
Pipe-to-shell patternbash_security/bash_malicious_commands.json:127 · Pipe-to-shell pattern — downloads and immediately executes remote code"危险参数": ["| bash", "| sh", "|/bin/bash", "| /bin/sh", "curl -s | sh", "curl -s | bash"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or devicebash_security/bash_ast_normalize.py:14 · Destructive command against a filesystem root or device7. 持久化/破坏: crontab / systemctl / rm -rf / iptables -FFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternbash_security/bash_categories.json:28 · Pipe-to-shell pattern — downloads and immediately executes remote code"wget | sh",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or devicebash_security/bash_categories.json:21 · Destructive command against a filesystem root or device"rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternbash_security/bash_categories.json:27 · Pipe-to-shell pattern — downloads and immediately executes remote code"curl | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06

Cost to the agent

Instructions loaded
≈1,799 tok
1 file · 53 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Unclaimed publisher≈ +8 on the totalClaim tsherryyann: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Host or command assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim tsherryyannPropose a patch to the maintainer