Skills/ClawHub/ui-agent

ui-agent@1.0.0

BLOCKED· static only

Publisher claims: "Universal UI automation for browsers and desktops. Chrome DevTools Protocol + native APIs. 15/15 verified tests." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher nimaansari · publishing for 235 daysInstalls 771Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 45/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: document.cookie access; Privileged sudo command; OS command execution function call detected. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Python subprocess execution detecteddocs/SKILL.md:312 · Python subprocess execution detectedsubprocess.run(["xdotool", "type", text], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
document.cookie accessSKILL.md:348 · document.cookie access — can steal session cookies2. `document.cookie =` writes directly to browser memory (instant, no disk needed)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedsrc/chrome_session_vbox_fixed.py:66 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detecteddocs/SKILL.md:297 · Python subprocess execution detectedsubprocess.run(["ydotool", "type", text], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detecteddocs/SKILL.md:305 · Python subprocess execution detectedsubprocess.run(["xdotool", "key", "ctrl+shift+v"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commanddocs/SKILL.md:390 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install gnome-screenshot scrot grimFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedsrc/cdp_typer.py:54 · OS command execution function call detectedos.system(f"pkill -f 'remote-debugging-port={CDP_PORT}' 2>/dev/null")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/chrome_session_vbox_fixed.py:59 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/desktop_helpers.py:41 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/cdp_typer.py:63 · Python subprocess execution detectedself._chrome = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandsrc/desktop_helpers.py:116 · Privileged sudo command — agent may execute with elevated privilegesraise RuntimeError("No screenshot tool: sudo apt-get install scrot")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detecteddocs/SKILL.md:304 · Python subprocess execution detectedsubprocess.run(["xclip", ...])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commanddocs/SKILL.md:95 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y ydotoolFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/chrome_session_vbox_fixed.py:121 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/desktop_helpers.py:26 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/chrome_session_vbox_fixed.py:46 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detecteddocs/SKILL.md:336 · Python subprocess execution detectedresult = subprocess.run(["pgrep", "-f", "chrome"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commanddocs/SKILL.md:98 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y scrot grimFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
document.cookie accessSKILL.md:334 · document.cookie access — can steal session cookiesjs = f"document.cookie = '{cookie['name']}={cookie['value']}; path=/; secure; samesite=none';"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedsrc/desktop_helpers.py:16 · Python subprocess execution detectedr = subprocess.run(["pgrep", "-f", f"Xvfb {DISPLAY_XVFB}"], capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandsrc/desktop_helpers.py:25 · Privileged sudo command — agent may execute with elevated privilegesraise RuntimeError("Xvfb not installed: sudo apt-get install xvfb")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/chrome_session_vbox_fixed.py:74 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commanddocs/SKILL.md:87 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commanddocs/SKILL.md:381 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install python3-gi gir1.2-atspi-2.0Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandsrc/desktop_helpers.py:76 · Privileged sudo command — agent may execute with elevated privilegesf"Install with: sudo apt-get install {app}"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/final_test_fm1.py:36 · Python subprocess execution detectedsubprocess.run(["pkill", "-x", "nautilus"], capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/verify_helpers.py:212 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_sp1_official.py:87 · Python subprocess execution detecteddead = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/run_final_all.py:39 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
document.cookie accesstests/test_sp1_official.py:14 · document.cookie access — can steal session cookies5. Restore via JS (document.cookie = ...)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/final_test_t1.py:21 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/final_test_fm1.py:26 · Python subprocess execution detectedpid_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/desktop_helpers.py:82 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/final_test_fm1.py:14 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/verify_helpers.py:219 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/final_test_fm1.py:21 · Python subprocess execution detectedrunning = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/desktop_helpers.py:110 · Python subprocess execution detectedr = subprocess.run(cmd, env=env, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
document.cookie accesstests/test_sp1_official.py:44 · document.cookie access — can steal session cookiesjs_cmd = f"document.cookie = '{COOKIE_NAME}={COOKIE_VALUE}; path=/; secure; samesite=none';"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
document.cookie accesstests/test_sp1_official.py:121 · document.cookie access — can steal session cookiesjs_set = f"document.cookie = '{name}={value}; path=/; secure; samesite=none';"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandtests/test_sp1_official.py:7 · Process kill command — agent can terminate processesacross Chrome kill and relaunch on VirtualBox.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈7,140 tok
2 files · 27 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

35 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim nimaansari: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim nimaansariPropose a patch to the maintainer