Skills/ClawHub/skill-publish-sync

skill-publish-sync@1.7.2

CAUTION· install only

Publisher claims: "将本地开发的 Skills 同步到 ClawHub、腾讯 SkillHub 与联想开放平台。支持智能 .gitignore 过滤、平台独立白名单、增量与单个 skill 同步。本技能应在用户需要将本地 skills 发布到上述平台、批量同步技能或检查发布状态时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher cat-xierluo · publishing for 89 daysInstalls 390Last detonated 12 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:37 · npx invocation of non-well-known package — may execute untrusted code| `lenovoskill`（`npx @lenovo-open/skill-cli`） | 上传到联想开放平台 | `npx @lenovo-open/skill-cli <cmd>`（免装，推荐）或 `npm i -g @lenovo-open/skill-cli` | 仅上传联想平台时 |Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandSKILL.md:26 · Privileged sudo command — agent may execute with elevated privileges| `rsync` | `prepare-publish.sh` 复制过滤文件到临时发布目录 | macOS 自带；Linux: `sudo apt-get install rsync` |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:463 · npx invocation of non-well-known package — may execute untrusted code| CLI | `clawhub` | `skillhub`（Python） | `lenovoskill`（`npx @lenovo-open/skill-cli`，Node.js） |Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/prepare-publish.sh:148 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--exclude='**/.env' # 排除环境变量文件（防止凭证泄露）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:693 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- [ ] 使用 `.env.example` 代替 `.env` 文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:697 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- `.env` - 环境变量（使用 `.env.example` 作为模板）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Pipe-to-shell patternSKILL.md:48 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:29 · npx invocation of non-well-known package — may execute untrusted code| Node.js（≥ 18）+ `npm` | 运行联想 `lenovoskill` CLI（`npx @lenovo-open/skill-cli` 走 Node.js 运行时） | macOS 自带或 `brew install node`；Linux: `sudo apt-get install -y nodejs npm` |Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandSKILL.md:28 · Privileged sudo command — agent may execute with elevated privileges| Python 3 | 运行腾讯 SkillHub CLI（Python 脚本） | macOS 自带；Linux: `sudo apt-get install python3` |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:92 · npx invocation of non-well-known package — may execute untrusted code| CLI 工具 | `clawhub` | `skillhub`（官方 CLI，`skillhub self-upgrade` 升级；**须 ≥ 2026.7.29** 才支持 publish/login） | `lenovoskill`（`npx @lenovo-open/skill-cli`，Node.js 运行时） |Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/push-lenovo-batch.sh:25 · npx invocation of non-well-known package — may execute untrusted codeNPM_CMD="npx -y @lenovo-open/skill-cli"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shellSKILL.md:48 · Remote installer piped to shellcurl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Privileged sudo commandSKILL.md:29 · Privileged sudo command — agent may execute with elevated privileges| Node.js（≥ 18）+ `npm` | 运行联想 `lenovoskill` CLI（`npx @lenovo-open/skill-cli` 走 Node.js 运行时） | macOS 自带或 `brew install node`；Linux: `sudo apt-get install -y nodejs npm` |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:27 · Privileged sudo command — agent may execute with elevated privileges| `git` | `prepare-publish.sh` 用 `git ls-files` 精确匹配追踪文件 | macOS 自带；Linux: `sudo apt-get install git` |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈6,808 tok
1 file · 10 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim cat-xierluo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cat-xierluoPropose a patch to the maintainer