Skills/ClawHub/remoet

remoet@1.5.2

VERIFIED· install only

Publisher claims: "Job search and career discovery through your agent. Search the open tech job board directly, or star the companies that match your stack for an ongoing feed of their roles, all by talking. Backed by company-level tech stack data derived from the roles each company is hiring for now." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher remoet · publishing for 58 daysInstalls 1,644Last detonated 47 h ago
$clawhub install remoet
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Prompting user to enter sensitive credentialsSKILL.md:81 · Prompting user to enter sensitive credentials — social engineering… this server require authentication?". Answer `n` to search keyless, or `y` and paste your API key, which Hermes saves to `~/.hermes/.env` as `MCP_REMOET_API_KEY` and wires into …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsSKILL.md:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ll on it. If you edit `mcp_servers` by hand instead, put the key in `~/.hermes/.env` as `REMOET_API_KEY`, not only in a shell export. (The `hermes mcp add` path st…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesThen make it available to your harness. How depends on the harness (Hermes keeps it in `~/.hermes/.env`, see below); for a plain shell:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:81 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…search keyless, or `y` and paste your API key, which Hermes saves to `~/.hermes/.env` as `MCP_REMOET_API_KEY` and wires into the Authorization header for you (the r…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈5,756 tok
1 file · 2 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.