What did Sigil's automated scan find in ocas-reach?

ocas-reach was flagged as CRITICAL RISK (risk score 170) with 22 findings detected across 117 files. Review the findings before installing.

What security issues were found in ocas-reach?

Sigil detected 22 findings in ocas-reach, including patterns related to install_hooks, network_exfil, code_patterns. See the full scan report for details.

Scans/clawhub/ocas-reach

ocas-reach

clawhub

Summary

ocas-reach v1.0.1 was classified as CRITICAL RISK with a risk score of 170. Sigil detected 22 findings across 117 files, covering phases including install hooks, network exfiltration, code patterns. Review the findings below before installing this package.

CRITICAL RISK(170)

v1.0.1

5 October 2026, 14:14 UTC

by Sigil Bot

Risk Score

170

Findings

Files Scanned

117

Provenance

Registry

https://clawhub.com/skills/ocas-reach

Scanned From

https://clawhub.ai/api/v1/download?slug=ocas-reach&version=1.0.1

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

LOW

Makefile/script pipes remote content to shell

references/gotchas.md:11

- **Check Reach before installing weather plugins.** Before installing any third-party weather plugin (e.g., hermes-weather-plugin), check whether ocas-reach already covers the needed data sources. `noaa_nws` handles US forecasts/alerts, `open_meteo` handles global weather, `usgs_earthquake` covers seismic events, `airnow` covers EPA air quality. If Reach already covers the required sources, prefer extending Reach over installing a heavy plugin — especially if the plugin depends on Rust/compiled

Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/ocas-reach)](https://sigilsec.ai/scans/6BD8C6FF-9240-417A-9487-394385E8A838)

HTML

<a href="https://sigilsec.ai/scans/6BD8C6FF-9240-417A-9487-394385E8A838"><img src="https://sigilsec.ai/badge/clawhub/ocas-reach" alt="Sigil Scan"></a>

Run This Scan Yourself