pooly@1.0.0

CAUTION

Publisher claims: "Read your Pooly group wallets — pools, USDC balances on Base, members, spending rules, agents, and spend history — through the official read-only Pooly MCP server. Can simulate a spend; never moves money." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher pooly · joined 2 days agoInstalls 42Last detonated 19 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packageSKILL.md:11 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageskill-card.md:29 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:56 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:69 · npx invocation of non-well-known package — may execute untrusted code

AST06