Skills/ClawHub/vet-translator

vet-translator@1.0.1

VERIFIED· install only

Publisher claims: "Decode veterinary visit notes, discharge summaries, and lab panels (CBC, chemistry, urinalysis) into plain language: what each value means, which results are actually abnormal for the animal's species/breed/age, flag concerning trends across visits, and generate a question list for the next appointment. Use when the user shares vet notes or bloodwork for a pet and asks what it means, whether results are normal, or wants trends tracked over time." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher voronindenis5 · publishing for 88 daysInstalls 421Last detonated 6d ago
$clawhub install vet-translator
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 91/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/test_vet_translator.py:105 · Python subprocess execution detectedr = subprocess.run([sys.executable, os.path.join(HERE, "vet_translator.py"),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_vet_translator.py:112 · Python subprocess execution detectedr = subprocess.run([sys.executable, os.path.join(HERE, "vet_translator.py"),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_vet_translator.py:119 · Python subprocess execution detectedr = subprocess.run([sys.executable, os.path.join(HERE, "vet_translator.py"), "demo"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈2,233 tok
1 file · 8 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

vet-translator@1.0.1 safety verdict: Verified (install only) — KillerSkills