Security checks across malware telemetry and agentic risk
Crabukit is a disclosed defensive security scanner; the dangerous-looking code is mainly scanner rules and test fixtures, with some expected install and lookup features users should understand.
Install only from the intended GitHub/PyPI or ClawHub source. Use `crabukit scan` as read-only analysis when possible; use `crabukit install` or the shell wrapper only when you intend to let it install a named skill. For private skill audits, be aware that Clawdex integration may disclose the scanned skill name when that integration is available.
"""
try:
# Call Clawdex API directly
result = subprocess.run(
["curl", "-s", f"https://clawdex.koi.security/api/skill/{skill_name}"],
capture_output=True,
text=True,return eval(user_data)
# Dangerous: exec with variable
exec(some_variable)
# Dangerous: subprocess with shell=True
user_input = input("Enter command: ")# Dangerous: subprocess with shell=True
user_input = input("Enter command: ")
subprocess.call(user_input, shell=True)
# Dangerous: os.system with variable
os.system(f"echo {user_input}")subprocess.call(user_input, shell=True)
# Dangerous: os.system with variable
os.system(f"echo {user_input}")
# Hardcoded secret (fake)
API_KEY = "AKIAIOSFODNN7EXAMPLE"# Dangerous: eval with user input
def process_user_input(user_data):
return eval(user_data)
# Dangerous: exec with variable
exec(some_variable)# Dangerous: subprocess with shell=True
user_input = input("Enter command: ")
subprocess.call(user_input, shell=True)
# Dangerous: os.system with variable
os.system(f"echo {user_input}")subprocess.call(user_input, shell=True)
# Dangerous: os.system with variable
os.system(f"echo {user_input}")
# Hardcoded secret (fake)
API_KEY = "AKIAIOSFODNN7EXAMPLE"64/64 vendors flagged this skill as clean.