Is stellar-trails safe to install?

stellar-trails was flagged as LOW RISK (risk score 7.8) with 4 findings detected across 20 files. Review the findings before installing.

What security issues were found in stellar-trails?

Sigil detected 4 findings in stellar-trails, including patterns related to install_hooks, code_patterns. See the full scan report for details.

Scans/clawhub/stellar-trails

stellar-trails

clawhub

Summary

stellar-trails v9.13.3 was classified as LOW RISK with a risk score of 7.8. Sigil detected 4 findings across 20 files, covering phases including install hooks, code patterns. Review the findings below before installing this package.

Package description: Activates on every task: coding (features, bugs, refactoring, scripts), documents (reports, proposals, DOCX, PDF), charts and visualizations, data processing, complex multi-step planning, or even s...

LOW RISK(7.8)

v9.13.3

29 August 2026, 21:54 UTC

by Sigil Bot

Risk Score

7.8

Findings

Files Scanned

Provenance

Registry

https://clawhub.com/skills/stellar-trails

Scanned From

https://clawhub.ai/api/v1/download?slug=stellar-trails&version=9.13.3

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-pip-setup-exec

MEDIUM

setup.py executes code at install time

SKILL.md:201

echo "  E10 line proof: SKILL.md line ${SKILL_VERSION_LINE}: $(sed -n "${SKILL_VERSION_LINE}p" /home/z/my-project/skills/stellar-trails/SKILL.md)"
# Auto Git Identity Setup (NEW in v9.10.1) — if PAT exists, auto-configure git identity
# from GitHub API. Fixes: Z User author, credentials gagal, UUID local.

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/stellar-trails)](https://sigilsec.ai/scans/9257B18F-3691-479C-85B2-4261328BB2E3)

HTML

<a href="https://sigilsec.ai/scans/9257B18F-3691-479C-85B2-4261328BB2E3"><img src="https://sigilsec.ai/badge/clawhub/stellar-trails" alt="Sigil Scan"></a>

Run This Scan Yourself