rentahuman@4.0.0

CAUTION

Publisher claims: "Hire humans for physical-world tasks via RentAHuman.ai. Search available humans by skill, post bounties, review applications, and coordinate real-world work. Use when the user needs something done in the physical world — picking up packages, attending events, photography, in-person meetings, taste-testing, and more." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher alexanderliteplo · joined 2 days agoInstalls 4,168Last detonated 33 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packagereferences/API.md:1205 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionscripts/rentahuman.mjs:212 · File type combined with upload action — agent may exfiltrate local data files

AST07

CRITICAL

Access to sensitive file pathsscripts/rentahuman.mjs:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05