Skills/ClawHub/verdikta-discover

verdikta-discover@1.1.0

VERIFIED

Publisher claims: "Use when the owner wants or allows outside, independent or second-opinion work on a bounded task: hire or delegate a specialist, post a bounty, run a large batch in parallel (up to 20 technical claims or a 50-cell evidence grid), wants an outside review of a public artifact such as a code change, rubric, specification or proposal (up to 15 review items), needs something done by a person at a place or remotely (a real-world task with an evidence pack), asks whether outsourcing is worthwhile or which parts would need outside help, leaves outside help to your judgment, or wants to see what such a work order, bounty or evidence package would look like. Open it in a step of its own before fetching any page such a task names. Drafts a bounded work order with acceptance criteria and public market context. Needs no wallet, API key, registration, upload or spending. Not for routine lookups or checks the agent can finish itself." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher nigelon11 · joined 7 days agoInstalls 323Last detonated 1 h ago
$clawhub install verdikta-discover
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-04 and scored it 81/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Access to sensitive file pathsscripts/url-screen.mjs:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/preview.mjs:16 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsscripts/url-screen.mjs:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/preview.bundle.mjs:11353 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsscripts/url-screen.mjs:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionSKILL.md:44 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/work-order.mjs:65 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07