Skills/ClawHub/ranchimall-messenger

ranchimall-messenger@1.0.21

VERIFIED· install only

Publisher claims: "Use this skill whenever you are asked to send or receive messages, manage contacts, read or send mail, manage groups, look up public keys, check FLO balance,..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher void-57 · publishing for 164 daysInstalls 1,708Last detonated 8 h ago
$clawhub install ranchimall-messenger
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 90/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionflo_node.js:106 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` From : ${senderAddr}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbtc_node.js:163 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` Inputs :`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionmail_node.js:219 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` From : ${found.raw.senderID || 'Unknown'}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbtc_node.js:167 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` Outputs :`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncloud_node.js:36 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n[cloud] Sending General Data...`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/floCloudAPI.js:702 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("[SEND] original:", originalReceiverID, "server:", serverReceiverID);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionflo_node.js:220 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n[flo] Sending TX multiple...`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionmail_node.js:167 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n From : ${raw.senderID || 'Unknown'}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncloud_node.js:49 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n[cloud] Sending Application Data...`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionreceive_node.js:123 · File type combined with upload action — agent may exfiltrate local data filesif (options.sender) console.log(`[receive] Filtering by sender: ${options.sender}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpubkey_node.js:76 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n[pubkey] Sending PUBLIC_KEY request to: ${targetAddress}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionmail_node.js:96 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n[mail] Sending to ${recipients.length} recipient(s)...`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiongroups_node.js:257 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n ${sender}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/messenger.js:424 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Migrating chat history from ${altID} to ${unparsed.senderID}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsend_node.js:156 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n[send] Sender: ${senderFloID}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiongroups_node.js:190 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n[groups] Sending to group: ${groupName} (${groupID})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionreceive_node.js:166 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`From: ${sender}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiontoken_node.js:146 · File type combined with upload action — agent may exfiltrate local data filesif (parsed.sender) console.log(` From : ${parsed.sender}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiontoken_node.js:170 · File type combined with upload action — agent may exfiltrate local data filesif (parsed.sender) console.log(` From : ${parsed.sender}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiontoken_node.js:99 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` From : ${senderAddr}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsend_node.js:164 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[send] Message encrypted');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsend_node.js:157 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`[send] Receiver: ${receiverFloID}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsend_node.js:172 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[send] Message sent successfully!', result);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsend_node.js:158 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`[send] Message: ${message}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈7,907 tok
1 file · 28 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

ranchimall-messenger@1.0.21 safety verdict: Verified (install only) — KillerSkills