Skills/ClawHub/wenqisheng-ear-care

wenqisheng-ear-care@1.1.1

BLOCKED· install only

Publisher claims: "可视采耳门店智能客服Skill。当用户询问关于闻其声耳轻松可视采耳（门店名称）的任何信息时触发：包括营业时间、地址导航、预约规则、服务项目、套餐优惠、Wi-Fi密码、企业文化、采耳及眼部护理专业知识问答等。适用于美业/采耳门店的AI客服场景，支持引导式话术和结构化信息查询。触发关键词：闻其声、耳轻松、可视采耳、采..." Observed in sandbox: sends data to fd12:ea5f:789c:1:5000:26:7c6e:98db, 10.238.152.219.

Registry ClawHubPublisher liubuq-sys · publishing for 170 daysInstalls 808Last detonated 49 min ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-14 and scored it 42/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Pipe-to-shell pattern; Access to sensitive file paths. Summary: sends data to fd12:ea5f:789c:1:5000:26:7c6e:98db, 10.238.152.219.

Behavior trace

Honeypot run · 2 s · 2 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
1.1snetworkdirect connection to fd12:ea5f:789c:1:5000:26:7c6e:98db:0, bypassing the egress proxy · undeclared
1.1snetworkdirect connection to 10.238.152.219:0, bypassing the egress proxy · undeclared
1.1sfilesystemread ~/.openclaw/workspace/skills/wenqisheng-ear-care outside project
1.1sfilesystemwrote ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/description · ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/info/exclude · ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/hooks/pre-rebase.sample · ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/hooks/push-to-checkout.sample · ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/hooks/pre-merge-commit.sample · ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/hooks/update.sample
1.1snetworkCONNECT tcp://github.com:443
1.1sprocessexec /usr/bin/mktemp
1.1sprocessexec /usr/bin/mkdir
1.1sprocessexec /usr/bin/git
1.1sprocessexec /usr/lib/git-core/git
1.1sprocessexec /usr/lib/git-core/git-remote-https
1.1sprocessexec /usr/bin/cp
1.1sprocessexec /usr/bin/grep
1.1sprocessexec /usr/bin/rm
1.1sprocessexited 127: ./install.sh: line 50: crontab: command not found
1.1sprocessscript backend runs setup only
1.1sprocessscript backend runs setup only
1.6sprocesssecond launch, clock +45 days, CI unset
2.2sfilesystemread ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/HEAD outside project
2.2sfilesystemwrote ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/objects/maintenance.lock · ~/.openclaw/workspace/skills/wenqisheng-ear-care/.git/ORIG_HEAD.lock
2.2snetworkCONNECT tcp://github.com:443
2.2sprocessexec /usr/bin/mktemp
2.2sprocessexec /usr/bin/mkdir
2.2sprocessexec /usr/bin/git
2.2sprocessexec /usr/lib/git-core/git
2.2sprocessexec /usr/lib/git-core/git-remote-https
2.2sprocessexec /usr/bin/grep
2.2sprocessexec /usr/bin/rm
2.2sprocessexited 127: ./install.sh: line 50: crontab: command not found

Static findings

HIGH
Access to sensitive file pathsbot-server/ai_client.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files切换方式: .env 中设置 AI_PROVIDER=deepseekFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patterninstall.sh:6 · Pipe-to-shell pattern — downloads and immediately executes remote code# curl -sSL https://raw.githubusercontent.com/Liubuq-sys/wenqisheng-ear-care-skill/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsbot-server/ai_client.py:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesAI 客户端 —— 支持多模型供应商，通过 .env 切换。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsbot-server/platforms/feishu.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files5. .env 中配置各应用的 App ID / SecretFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME_EN.md:29 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileAdd this to `~/.openclaw/CLAUDE.md` for fully automatic install when anyone mentions ear-cleaning keywords to the Agent:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsbot-server/platforms/wecom.py:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files4. Token 和 EncodingAESKey 填入 .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:6 · Remote installer piped to shell# curl -sSL https://raw.githubusercontent.com/Liubuq-sys/wenqisheng-ear-care-skill/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandscripts/auto_update.sh:7 · File permission modification command — agent changes file ownership/permissions# 2. chmod +x auto_update.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Direct script execution from GitHub raw URLinstall.sh:6 · Direct script execution from GitHub raw URL — unverified code source# curl -sSL https://raw.githubusercontent.com/Liubuq-sys/wenqisheng-ear-care-skill/main/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsbot-server/main.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .env # 编辑填好 API KeyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,619 tok
1 file · 29 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

38 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim liubuq-sys: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim liubuq-sysPropose a patch to the maintainer