1001eligible findings
10rule/source strata
35selected samples
Not measuredpublishable precision

Stratified cohort

STATIC_CREDENTIAL_EXFILTRATION_CHAINclawhub1 selected / 1 eligible
STATIC_DESTRUCTIVE_ROOT_COMMANDclawhub4 selected / 8 eligible
STATIC_DOWNLOAD_PIPE_TO_SHELLclawhub4 selected / 437 eligible
STATIC_DOWNLOAD_PIPE_TO_SHELLgithub4 selected / 7 eligible
STATIC_DYNAMIC_CODE_EXECUTIONclawhub4 selected / 215 eligible
STATIC_DYNAMIC_CODE_EXECUTIONgithub2 selected / 2 eligible
STATIC_OBFUSCATED_EXECUTIONclawhub4 selected / 84 eligible
STATIC_OBFUSCATED_EXECUTIONgithub4 selected / 10 eligible
STATIC_SENSITIVE_CREDENTIAL_ACCESSclawhub4 selected / 224 eligible
STATIC_SENSITIVE_FILE_IN_PACKAGEclawhub4 selected / 13 eligible

Sample audit list

mcp-best-practicesSTATIC_CREDENTIAL_EXFILTRATION_CHAIN · clawhubreferences/security-auth.md:172 · unlabelled
AgentGuardSTATIC_DESTRUCTIVE_ROOT_COMMAND · clawhubSKILL.md:603 · unlabelled
zhongkui-skillSTATIC_DESTRUCTIVE_ROOT_COMMAND · clawhubreferences/behavioral-emulation.md:76 · unlabelled
DACHSERSTATIC_DOWNLOAD_PIPE_TO_SHELL · clawhubSKILL.md:57 · unlabelled
Google CalendarSTATIC_DOWNLOAD_PIPE_TO_SHELL · clawhubSKILL.md:92 · unlabelled
tencent-newsSTATIC_DOWNLOAD_PIPE_TO_SHELL · clawhubSKILL.md:49 · unlabelled
code-reviewSTATIC_DOWNLOAD_PIPE_TO_SHELL · githubSKILL.md:24 · unlabelled
boltz-cli-setupSTATIC_DOWNLOAD_PIPE_TO_SHELL · githubreferences/sandbox.md:24 · unlabelled
zwjh-skillSTATIC_DYNAMIC_CODE_EXECUTION · clawhubscripts/setup.py:49 · unlabelled
generate-html-pptSTATIC_DYNAMIC_CODE_EXECUTION · clawhubscripts/validate-swiss-deck.mjs:150 · unlabelled
sandbox-sdkSTATIC_DYNAMIC_CODE_EXECUTION · githubSKILL.md:109 · unlabelled
google-docsSTATIC_DYNAMIC_CODE_EXECUTION · githubhost/docs-dropdown-file-bridge.mjs:41 · unlabelled
Skill AuditorSTATIC_OBFUSCATED_EXECUTION · clawhubscripts/score.py:98 · unlabelled
zhongkui-skillSTATIC_OBFUSCATED_EXECUTION · clawhubreferences/trust-hierarchy.md:36 · unlabelled
build-reportSTATIC_OBFUSCATED_EXECUTION · githubscripts/extract_portable_chart_svgs.mjs:422 · unlabelled
google-slidesSTATIC_OBFUSCATED_EXECUTION · githubhost/export-and-render-slides.mjs:257 · unlabelled
produceSTATIC_OBFUSCATED_EXECUTION · githubhelpers/moodboards/assets/mood-board-app/app.js:403 · unlabelled
sunsamaSTATIC_SENSITIVE_CREDENTIAL_ACCESS · clawhubSKILL.md:56 · unlabelled
BrevoSTATIC_SENSITIVE_CREDENTIAL_ACCESS · clawhubSKILL.md:55 · unlabelled
botlearnSTATIC_SENSITIVE_FILE_IN_PACKAGE · clawhubtemplates/credentials.json · unlabelled
Openclaw MeshSTATIC_SENSITIVE_FILE_IN_PACKAGE · clawhub.env.example · unlabelled

Interpretation boundary