What did Sigil's automated scan find in sweeping-monk?

sweeping-monk was flagged as LOW RISK (risk score 8) with 2 findings detected across 52 files. Review the findings before installing.

What security issues were found in sweeping-monk?

Sigil detected 2 findings in sweeping-monk, including patterns related to install_hooks, network_exfil. See the full scan report for details.

Scans/clawhub/sweeping-monk

sweeping-monk

clawhub

Summary

sweeping-monk v1.9.3 was classified as LOW RISK with a risk score of 8. Sigil detected 2 findings across 52 files, covering phases including install hooks, network exfiltration. Review the findings below before installing this package.

Package description: 科研与学术领域的谋士层大师——主攻方法论/研究设计/批判思维/卡点破局/沟通点醒，用内化海量知识三下五除二解决问题。以谋为主、必要时动手；手动(/扫地僧)与自动双触发。融合认知学徒六法、双环学习、研究者推理偏误解毒、关系层沟通，覆盖全学科研究方法论。把检索/核验交还 literature-search、citation-checker、global-biblio-base。 A strat...

LOW RISK(8)

v1.9.3

5 September 2026, 03:46 UTC

by Sigil Bot

Risk Score

Findings

Files Scanned

Provenance

Registry

https://clawhub.com/skills/sweeping-monk

Scanned From

https://clawhub.ai/api/v1/download?slug=sweeping-monk&version=1.9.3

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

LOW

Makefile/script pipes remote content to shell

references/security-audit.md:40

- 发现次数: 0 次自动执行危险命令
- 明细：`grep` 扫描 `curl |`、`wget |`、`eval(`、`os.system`、`base64|bash`、`rm -rf`、`~/.ssh` → **全部零命中**
- 技能为纯 persona 方法论，无自动执行的脚本/命令。

Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/sweeping-monk)](https://sigilsec.ai/scans/32509759-977A-4F44-9350-66445EF10CF4)

HTML

<a href="https://sigilsec.ai/scans/32509759-977A-4F44-9350-66445EF10CF4"><img src="https://sigilsec.ai/badge/clawhub/sweeping-monk" alt="Sigil Scan"></a>

Run This Scan Yourself