Skills/ClawHub/syncbook

syncbook@1.0.0

CAUTION

Publisher claims: "Help a person join Syncbook, enrich their profile from authorized context, share Syncbook questions or feedback, and review weekly progress and meaningful reciprocal connections. Use for Syncbook onboarding, connection possibilities, product feedback, and an explicitly authorized weekly routine." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher theguysaccount · joined 1 days agoInstalls 69Last detonated 17 h ago
Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

CRITICAL
Access to sensitive file pathsscripts/syncbook.mjs:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsscripts/syncbook.mjs:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
MEDIUM
File type combined with upload actionscripts/syncbook.mjs:30 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionscripts/syncbook.mjs:28 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionscripts/syncbook.mjs:33 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionscripts/syncbook.mjs:25 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionreferences/api.md:3 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
File permission modification commandscripts/syncbook.mjs:4 · File permission modification command — agent changes file ownership/permissions
AST05
HIGH
npx invocation of non-well-known packageREADME.md:20 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
File type combined with upload actionscripts/syncbook.mjs:35 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionSKILL.md:22 · File type combined with upload action — agent may exfiltrate local data files
AST07