Skills/ClawHub/subgraph-registry

subgraph-registry@0.13.3

VERIFIED· startup only

Publisher claims: "Use to discover The Graph subgraphs by chain, protocol, entity or contract and turn a goal into a bounded GraphQL query. Bring-your-own Studio key (set up by a human operator) for execution; discovery never executes queries or signs payments, and x402 is an explicitly paid external option." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher paulieb14 · publishing for 97 daysInstalls 4,606Last detonated 3d ago
$clawhub install subgraph-registry
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 31 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
11sprocessdependency install exit 0
31sclaimedstartup only: exited (0) before answering · at ModuleJob.run (node:internal/modules/esm/module_job:343:25) at process.processTicksAndRejections (node:internal/process/task_queues:103:5) at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:681:26) at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5)
31sprocessscript backend runs setup only
31sprocessno install scripts to re-run

Static findings

MEDIUM
Access to sensitive file pathstest/release-only.test.mjs:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files]) assert.throws(() => assertContext({ ...env, ...change }, version, sha));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code…and x402 is an explicitly paid external option. compatibility: "Node.js 20+ via npx -y [email protected] (stdio, no listener). Network: discovery tools mak…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/scanner-hygiene.test.mjs:35 · npx invocation of non-well-known package — may execute untrusted codeassert.doesNotMatch(src, /subgraph-registry-mcp@\$\{/, "no variable-built npx spec");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/scanner-hygiene.test.mjs:32 · npx invocation of non-well-known package — may execute untrusted codetest("npx references are literal and pinned to this release", () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:222 · npx invocation of non-well-known package — may execute untrusted code… as the token. - **Tool scope:** this skill uses only this server's MCP tools, `npx -y [email protected]` to start it, and, if the operator chooses, a `cur…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/index.js:43 · npx invocation of non-well-known package — may execute untrusted code// Literal, exact-version npx spec used in generated config examples. BumpedFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/scanner-hygiene.test.mjs:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst used = new Set([...src.matchAll(/process\.env\.([A-Z][A-Z0-9_]+)/g)].map((m) => m[1]));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:211 · npx invocation of non-well-known package — may execute untrusted codenpx -y [email protected]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:5 · npx invocation of non-well-known package — may execute untrusted codeallowed-tools: "Bash(npx -y [email protected]) Bash(curl -sS -X POST https://gateway.thegraph.com/api/subgraphs/id/*) mcp__subgraph-registry__*"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:144 · npx invocation of non-well-known package — may execute untrusted code`claude mcp add --env THE_GRAPH_STUDIO_API_KEY="$THE_GRAPH_STUDIO_API_KEY" --transport stdio subgraph-registry -- npx -y [email protected]`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/index.js:1476 · npx invocation of non-well-known package — may execute untrusted codefix: "Reinstall the exact published package (npx -y " + PINNED_NPX_PACKAGE + "), which bundles the model. No download is attempted.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionsrc/index.js:3118 · File type combined with upload action — agent may exfiltrate local data filesres.status(401).json({ error: "unauthorized", hint: "Send Authorization: Bearer <token>." });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagetest/scanner-hygiene.test.mjs:2 · npx invocation of non-well-known package — may execute untrusted code// pins, literal pinned npx references, bundled-model-only semantic searchFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetest/release-only.test.mjs:128 · npx invocation of non-well-known package — may execute untrusted codeput("SKILL.md", `npx ${PACKAGE}@${version}\nThe npm package version \`${version}\` ships\nSHA-256(registry.db) = ${dbHash}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandsrc/index.js:698 · Process kill command — agent can terminate processes// Keep the OR (dropping to AND would kill recall on descriptions thatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagetest/scanner-hygiene.test.mjs:41 · npx invocation of non-well-known package — may execute untrusted codeassert.doesNotMatch(text, /npx(?:\s+-y)?\s+subgraph-registry-mcp(?![@\w-])/, `${f} has an unpinned npx reference`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈5,849 tok
1 file · 24 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.