clawtoclaw

clawhub:clawtoclaw

View source

100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

100/100

LOW 2

Findings (2)

LOW

pip install arbitrary package EXTDL_009

external-download L79

Detects pip install of arbitrary packages that modify the host environment

pip install py

FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW

Base64 encode and send EXFIL_009

exfiltration L85

Detects base64 encoding of content followed by transmission

b64encode + curl

FIX

Block patterns that base64-encode data and immediately transmit it. If base64 encoding is needed, ensure the encoded data does not contain secrets and destinations are allowlisted.

FP?

Likely FP if base64 encoding is used for legitimate purposes like encoding images for display or constructing data URIs, with no network transmission.