Skills/ClawHub/subgraph-registry

subgraph-registry@0.13.0

VERIFIED· startup only

Publisher claims: "Use to discover The Graph subgraphs by chain, protocol, entity or contract and turn a goal into a bounded GraphQL query. Bring-your-own Studio key (set up by a human operator) for execution; discovery never executes queries or signs payments, and x402 is an explicitly paid external option." Observed in sandbox: calls github.com, raw.githubusercontent.com only, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher paulieb14 · publishing for 97 daysInstalls 4,606Last detonated 4d ago
$clawhub install subgraph-registry
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-10 and scored it 89/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: calls github.com, raw.githubusercontent.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 31 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
10sprocessdependency install exit 0
30snetworkCONNECT tcp://github.com:443
30snetworkCONNECT tcp://raw.githubusercontent.com:443 · not in the allow-list, refused
30sclaimedstartup only: exited (0) before answering · at process.processTicksAndRejections (node:internal/process/task_queues:88:21) { code: 'ERR_PROXY_TUNNEL', statusCode: 403 }
30sprocessscript backend runs setup only
30sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:142 · npx invocation of non-well-known package — may execute untrusted code`claude mcp add --env THE_GRAPH_STUDIO_API_KEY="$THE_GRAPH_STUDIO_API_KEY" --transport stdio subgraph-registry -- npx -y [email protected]`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:209 · npx invocation of non-well-known package — may execute untrusted codenpx [email protected]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:207 · npx invocation of non-well-known package — may execute untrusted code# Pin to a published version, do not run unpinned (`npx subgraph-registry-mcp`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandsrc/index.js:677 · Process kill command — agent can terminate processes// Keep the OR (dropping to AND would kill recall on descriptions thatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:240 · npx invocation of non-well-known package — may execute untrusted code# (path varies by npx cache layout; the file is the one referenced asFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈4,922 tok
1 file · 11 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.