Find Skills

This skill failed 2 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

• No undeclared network calls: failed

  Contacts 1 host that is neither well-known infrastructure nor declared in the skill's frontmatter: clawhub.ai.

  Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

  Hosts contacted

  skills.shsource hostwww.skills.shsource hostclawhub.aiundeclaredraw.githubusercontent.comsource host

  What it found (3 of 4)

  • find-skills/scripts/find.sh:87contacts clawhub.ai

    search=$(curl -sS --max-time 15 "https://clawhub.ai/api/search?q=${ENC_QUERY}" 2>/dev/null)

  • find-skills/scripts/find.sh:93contacts clawhub.ai

    { curl -sS --max-time 10 "https://clawhub.ai/api/skill?slug=${slug}" 2>/dev/null \

  • find-skills/scripts/find.sh:98contacts clawhub.ai

    updatedAt:($s.updatedAt//null), url:("https://clawhub.ai/skill/"+($s.slug//"")),

• No credential access: failed

  Touches credential material in 2 places.

  Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  What it found

  • find-skills/scripts/find.sh:164SSH private keys or config

    grep -Eiq '(~/\.ssh|~/\.aws|/\.env\b|id_rsa|AWS_SECRET|PRIVATE_KEY)' "$f" && { flags+="reads-secrets;"; [ "$level" = clean ] && level="caution"; }

  • find-skills/scripts/find.sh:164environment file outside the project

    grep -Eiq '(~/\.ssh|~/\.aws|/\.env\b|id_rsa|AWS_SECRET|PRIVATE_KEY)' "$f" && { flags+="reads-secrets;"; [ "$level" = clean ] && level="caution"; }

• Declares what it does: passed

  SKILL.md parses and declares a name and a description.

  SKILL.md exists, its frontmatter parses, and it declares a name and a description.

• No obfuscated payloads: passed

  No encoded or obfuscated payloads.

  No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

• No pipe-to-shell installers: passed

  No pipe-to-shell or download-and-run installers.

  No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

• Pinned to a commit: passed

  Scanned agentspace-so/skills at 88d28ef1d7.

  The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit

88d28ef1d7

Manifest

find-skills/SKILL.md

Scanned

2 files, 428 lines