Skills/ClawHub/skill-release-plus

skill-release-plus@1.1.1

CAUTION· install only

Publisher claims: "Multi-hub skill publisher. Sign → Audit (placeholder) → Pack (clean tar.gz with exclude rules) → Publish to clawhub.com, skillhub.cn (Tencent Cloud), or GitHub Releases, all in one command. Pluggable adapter framework — add your own hub via a user-hook script (subprocess + JSON envelope). Single source of truth: one exclude.json, one signing pass, one package, fan out to N targets. Default target: clawhub only. Use --target all for all three real hubs, or --target user-hook:./my-script.sh for custom destinations. Triggers on: publish skill, release skill, push to skill hub, ship skill to multiple hubs, 发布 skill, 上传到 clawhub, 发布到 skillhub.cn, package only, 打包不发布." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher songhonglei · publishing for 1 daysInstalls 533Last detonated 23 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsscripts/_lib_package.py:81 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".netrc", ".npmrc", ".pypirc",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandSKILL.md:207 · File permission modification command — agent changes file ownership/permissionschmod +x my-publisher.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/_adapter_clawhub.py:148 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/_lib_config.py:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_lib_config.py — Shared config loader with .env support + onboarding.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files4. **Global `~/.config/skill-release-plus/.env`**Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_lib_package.py:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.*", # .env.staging / .env.production 等（.env/.env.local 在用户层）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_lib_package.py:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env", ".env.local",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsconfig/exclude.json:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/_lib_config.py:233 · File permission modification command — agent changes file ownership/permissions"""Append (or overwrite) keys to global .env with chmod 600."""Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/_lib_package.py:336 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_adapter_github_release.py:123 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/_adapter_user_hook.py:67 · File permission modification command — agent changes file ownership/permissionsf"hook script not executable (chmod +x {self.hook_path})"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
URL with embedded credentialsscripts/_adapter_github_release.py:133 · URL with embedded credentials — may be phishing or credential leakingreturn f"https://x-access-token:{self.token}@github.com/{owner}/{repo}.git"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedscripts/_adapter_clawhub.py:89 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsSKILL.md:138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. **Project-local `./.env`**Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_lib_config.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesGLOBAL_ENV_FILE = GLOBAL_CONFIG_DIR / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsconfig/exclude.json:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.local",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_lib_config.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesPROJECT_ENV_FILE = Path.cwd() / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:221 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Secrets: `.env`, `.secrets`, `*.pem`, `*.key`, `.token`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/_adapter_clawhub.py:51 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsSKILL.md:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(`*.pem` / `*.key` / `id_rsa*` / `credentials.json` / `.env.*` /Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/_adapter_clawhub.py:71 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_adapter_user_hook.py:88 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/_lib_config.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. Project-local `./.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/_lib_config.py:235 · File permission modification command — agent changes file ownership/permissions# chmod 700 on parentFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/_lib_config.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files4. Global `~/.config/skill-release-plus/.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈3,429 tok
1 file · 12 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim songhonglei: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim songhongleiPropose a patch to the maintainer