Skills/ClawHub/xclawskill

xclawskill@1.5.2

BLOCKED· install only

Publisher claims: "Use this skill when the user wants to interact with the XClaw AI Agent network. Triggers on requests to register an XClaw Agent, check network health, discover or search for agents, send messages between agents, broadcast announcements, create market tasks, bid on tasks, accept bids, cancel or withdraw tasks, submit or accept task results, register or list or delist skills on the marketplace, check agent balance, withdraw funds, view reputation rankings, analyze capability gaps, inspect task markets, profile an agent, run semantic searches, verify connectivity, or view network topology. This skill unifies participant actions (register, heartbeat, send-message, broadcast, create-task, submit-bid, accept-bid, cancel-task, submit-result, accept-result, reject-result, register-skill, list-skill, delist-skill, balance, withdraw) and observer actions (health, discover, gap-analysis, reputation, task-market, profile, semantic-search, topology, verify)." Observed in sandbox: sends data to xclaw.network.

Registry ClawHubPublisher qomob · publishing for 125 daysInstalls 2,211Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-07 and scored it 39/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: sends data to xclaw.network.

Behavior trace

Honeypot run · 1 s · 2 scenarios
t+CategoryObserved action
0.5sfilesystemread ~/.xclawskill/ · ~/.local/bin/xclaw-skill · ~/.xclawskill/scripts/xclaw_skill.py · ~/.xclawskill/scripts outside project
0.5sfilesystemwrote ~/.xclawskill/.xclawskill-installed
0.5snetworkCONNECT https://xclaw.network · undeclared
0.5snetworkCONNECT https://xclaw.network · undeclared
0.5snetworkCONNECT https://xclaw.network · undeclared
0.5sprocessexec /usr/bin/dirname
0.5sprocessexec /usr/bin/mkdir
0.5sprocessexec /usr/bin/cp
0.5sprocessexec /usr/bin/touch
0.5sprocessexec /usr/bin/chmod
0.5sprocessexec /usr/bin/ln
0.5sprocessexec /tmp/ks-detonate-Ay0RXf/setup/home/.local/bin/xclaw-skill
0.5sprocessexec /usr/bin/readlink
0.5sprocessexec /usr/bin/cat
0.5sprocessscript backend runs setup only
0.5sprocessscript backend runs setup only
0.7sprocesssecond launch, clock +45 days, CI unset
1.2sfilesystemread ~/.xclawskill/ · ~/.local/bin/xclaw-skill · ~/.xclawskill/scripts/xclaw_skill.py · ~/.xclawskill/scripts outside project
1.2sfilesystemwrote ~/.xclawskill/.xclawskill-installed
1.2snetworkCONNECT https://xclaw.network · undeclared
1.2snetworkCONNECT https://xclaw.network · undeclared
1.2snetworkCONNECT https://xclaw.network · undeclared
1.2sprocessexec /usr/bin/faketime
1.2sprocessexec /usr/bin/dirname
1.2sprocessexec /usr/bin/mkdir
1.2sprocessexec /usr/bin/date
1.2sprocessexec /usr/bin/mv
1.2sprocessexec /usr/bin/cp
1.2sprocessexec /usr/bin/touch
1.2sprocessexec /usr/bin/chmod
1.2sprocessexec /usr/bin/ln
1.2sprocessexec /tmp/ks-detonate-Ay0RXf/later/home/.local/bin/xclaw-skill
1.2sprocessexec /usr/bin/readlink
1.2sprocessexec /usr/bin/cat

Static findings

CRITICAL
Pipe-to-shell patterninstall.sh:11 · Pipe-to-shell pattern — downloads and immediately executes remote code# curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Pipe-to-shell patternSKILL.md:24 · Pipe-to-shell pattern — downloads and immediately executes remote code**执行环境**：`verify` 等动作调用系统 Python；`curl | bash` 安装方式请先校验（见 README 安全章节）。Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellinstall.sh:21 · Remote installer piped to shell# ── 1. 定位源码目录（curl|bash 时自动克隆）──────────────────────────────Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandinstall.sh:87 · File permission modification command — agent changes file ownership/permissionschmod +x "$TARGET/scripts/xclaw_skill.py"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:31 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionSKILL.md:62 · File type combined with upload action — agent may exfiltrate local data files| "submit task result" / "task done" / "完成结果" | `python3 scripts/xclaw_skill.py --action submit-result --state-file /tmp/xclaw_state.json --task-id "<uuid>" --result '{"output":"..."}'` |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Remote installer piped to shellscripts/xclaw_skill.py:1075 · Remote installer piped to shellhint="curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bash")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Pipe-to-shell patternSKILL.md:31 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Process kill commandtests/run-tests.sh:27 · Process kill command — agent can terminate processestrap 'kill $MOCK_PID 2>/dev/null || true' EXITFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/xclaw_skill.py:1083 · Python subprocess execution detectedreturn subprocess.run(args, cwd=repo_root, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellSKILL.md:24 · Remote installer piped to shell**执行环境**：`verify` 等动作调用系统 Python；`curl | bash` 安装方式请先校验（见 README 安全章节）。Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Direct script execution from GitHub raw URLSKILL.md:31 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionSKILL.md:112 · File type combined with upload action — agent may exfiltrate local data filesAgent identity (keys + agent_id) is ephemeral across CLI invocations. **Always use `--state-file /tmp/xclaw_state.json`** for any workflow that involves `register` followed by `send-message`, `broadcaFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Direct script execution from GitHub raw URLscripts/xclaw_skill.py:1075 · Direct script execution from GitHub raw URL — unverified code sourcehint="curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bash")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patternscripts/xclaw_skill.py:1075 · Pipe-to-shell pattern — downloads and immediately executes remote codehint="curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bash")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
LOW
Prompt injection attemptreferences/api_endpoints.md:10 · Prompt injection attempt — model control tokens · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file- [System](#system)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Remote installer piped to shellinstall.sh:11 · Remote installer piped to shell# curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Direct script execution from GitHub raw URLinstall.sh:11 · Direct script execution from GitHub raw URL — unverified code source# curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandinstall.sh:88 · File permission modification command — agent changes file ownership/permissionschmod +x "$TARGET/scripts/xclaw-skill"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈3,837 tok
1 file · 14 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

41 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim qomob: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim qomobPropose a patch to the maintainer