Skills/ClawHub/psyseal-scan

psyseal-scan@0.3.3

CAUTION· startup only

Publisher claims: "Offline, read-only scan of your AI agent (OpenClaw, Hermes Agent, nanobot, PicoClaw, ZeroClaw, NanoClaw or any agent folder): what loads on every message, what heartbeats and scheduled tasks cost, plaintext secrets, and planted or bloated memory. No network, no dependencies." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher psyseal · publishing for 5 daysInstalls 120Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sfilesystemread ~ outside project
20sclaimedstartup only: exited (0) before answering · Si lo usas en otro lugar: - En un servidor (VPS): corre el escáner en ese servidor; así tus archivos no salen de ahí. - Si está en otra carpeta: pasa --path <carpeta de tu agente>. Si es otra plataforma, el escáner revisa credenciales, instrucciones sospechosas y memoria inflada. Privacidad: este escaneo no usa red, no escribe archivos y nunca imprime el contenido de tu memoria ni tus credenci
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/platforms/hermes.mjs:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstores: secretStores(h, ['.env', 'auth.json', '.anthropic_oauth.json']),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/common.mjs:141 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst ALWAYS_SECRET = /^(?:\.env(?:\..+)?|auth\.json|\.secret_key|\.anthropic_oauth\.json|\.security\.yml|credentials(?:\.json)?)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/nanobot.mjs:130 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstores: secretStores(root, ['config.json', '.env']),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/nanoclaw.mjs:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst stores = secretStores(root, ['.env']);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/generic.mjs:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstores: secretStores(root, ['.env', '.env.local']),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/i18n.mjs:343 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ised), delete those lines and keep keys where your platform stores credentials (.env or environment variables).', }), 'config.secret_plaintext': (items)…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/zeroclaw.mjs:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst stores = secretStores(root, ['config.toml', '.secret_key', '.env']);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/scan.mjs:389 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst ocEnv = pathTarget?.openclaw ? { ...env, OPENCLAW_STATE_DIR: path.resolve(opts.path) } : env;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/detectors/secrets.mjs:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…me|cambia|placeholder|redacted|todo|none|null|undefined|true|false|env:|process\.env|secret:|\*+|\.\.\.)/i; function distinctChars(s) { return new Set(s).size; }…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/common.mjs:144 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Archivos de credenciales de la plataforma que existen, con sus permisos. Los archivos de credenciales (.env, auth.json…)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/i18n.mjs:395 · File permission modification command — agent changes file ownership/permissionsfix: 'Restrict them to your user: chmod 600 <file>.',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/platforms/nanoclaw.mjs:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// las credenciales están en .env en la raíz de la instalación.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/hermes.mjs:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst looksLike = ['config.yaml', 'memories', 'SOUL.md', 'skills', 'state.db', '.env'].some((n) => fs.existsSync(path.join(root, n)));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/platforms/hermes.mjs:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// ~/.hermes (o HERMES_HOME) con config.yaml, .env, auth.json, SOUL.md, memories/MEMORY.md y memories/USER.mdFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/i18n.mjs:144 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files… borra esas líneas y guarda las claves donde tu plataforma guarda credenciales (.env o variables de entorno).', }), 'config.secret_plaintext': (items) =…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/i18n.mjs:196 · File permission modification command — agent changes file ownership/permissionsfix: 'Déjalos solo para tu usuario: chmod 600 <archivo>.',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive file system command detectedsrc/safe.mjs:3 · Destructive file system command detected// workspace podría poner en ellos secuencias de escape de terminal, saltos de línea (para falsificar líneas delFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/detectors/injection.mjs:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…eys?|tokens?|passwords?|secrets?|credentials?|private\\s+keys?|seed\\s+phrase|\\.env\\b|claves?|contrase[nñ]as?|credenciales)\\b[^\\n]{0,120}?(?:${L}(?:to|a|al|haci…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patternsrc/scan.mjs:232 · Pipe-to-shell pattern — downloads and immediately executes remote code// En skills son comunes las instrucciones de instalación (curl … | sh): se marcan para revisar, no como alarma.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellsrc/scan.mjs:232 · Remote installer piped to shell// En skills son comunes las instrucciones de instalación (curl … | sh): se marcan para revisar, no como alarma.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

Cost to the agent

Instructions loaded
≈1,346 tok
1 file · 33 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim psyseal: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim psysealPropose a patch to the maintainer