Skills/ClawHub/speediance-cli-scan-pr34-r3

speediance-cli-scan-pr34-r3@1.0.0

CAUTION· static only

Publisher claims: "Read completed workouts (summaries and full per-set detail), browse and export the exercise catalog, and push custom training programs to your Speediance (Gym Monster) smart cable machine via its cloud API. Authenticates with your account credentials, caches a session token in your OS user-cache directory (override with an exported SPEEDIANCE_TOKEN_CACHE), and makes outbound HTTPS requests to the Speediance cloud API. Reads and emits structured data. It writes local files only in these cases: the session token cache; config.json when you run `config set`, which stores the value you give it (including a password) as plain JSON with owner-only permissions; and the exercise catalog that the `library` command saves (default library.json). Ships as a single static binary — no Python or other runtime required." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher stozo04 · publishing for 131 daysInstalls 0Last detonated 17 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsSKILL.md:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdescription: "Path to config.json (overrides discovery: working dir, then OS user-config dir). Read from the exported environment only, never from .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdescription: "Override the token cache file location (default: OS user-cache dir). Read from the exported environment only, never from .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:116 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthose keys are read; the file is parsed into a map and any other keys are ignored, so a stray `.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinternal/config/config.go:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswarnings = append(warnings, fmt.Sprintf("%s in .env is ignored: path settings must be exported", key))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesYou can also put these four variables in a gitignored **`.env`** file in the working directory —Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinternal/config/config.go:235 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"%w: set %s and %s (exported env vars, or a .env in the working directory), "+Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…dential/config file (working directory, or your OS user-config dir)" - ".env — optional env file in the working directory; only the SPEEDIANCE_EMAIL, SPEEDI…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈4,173 tok
1 file · 32 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim stozo04: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim stozo04Propose a patch to the maintainer