skill-scanner@1.0.0
VERIFIEDPublisher claims: "Same tool as the ironheights skill. Security scanner for skills. Use before installing any skill from ClawHub or GitHub: flags malware, pipe-to-shell, encoded payloads, credential theft." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher frank-masciopinto · joined 2 days agoInstalls 33Last detonated 43 h ago
$npx skills add skill-scanner
Report an issueBehavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
npx invocation of non-well-known packageSKILL.md:26 · npx invocation of non-well-known package — may execute untrusted code
AST06No other findings across 129 lines in 2 files.