Summary
opphub v2.9.15 was classified as CRITICAL RISK with a risk score of 95. Sigil detected 7 findings across 33 files, covering phases including install hooks, code patterns. Review the findings below before installing this package.
Package description: 偶合 OppHub · 商业撮合 + 能力交换 · 公开 OPC · 5 通道独立推送 · 邮箱 / 手机号注册
v2.9.15
19 July 2026, 22:17 UTC
by Sigil Bot
Risk Score
95
Findings
7
Files Scanned
33
Provenance
Findings by Phase
Phase Ordering
Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.
install-makefile-curl
LOWMakefile/script pipes remote content to shell
CHANGELOG.md:429
- 方式 2 从 npx 模式（1.0.8）改为偶合官方 install.sh 模式
- 命令：`curl -fsSL https://api.opphub.ruiplus.cn/install.sh | bash`
- 加 OpenClaw runtime 安全提示说明Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
LOWMakefile/script pipes remote content to shell
SKILL.md:79
```bash
curl -fsSL https://api.opphub.ruiplus.cn/install/skill.sh | bash
```Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
HIGHMakefile/script pipes remote content to shell
bin/publish-skillhub.sh:59
echo "[publish-skillhub] skillhub CLI 不存在, 自动引导 install" >&2
curl -fsSL https://skillhub.cn/install/install.sh | bash -s -- --cli-only >&2 || {
echo "install failed" >&2; exit 1Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
HIGHMakefile/script pipes remote content to shell
lib/opphub-install-source.sh:290
echo "[opphub-update] 请用以下任一方式升级:"
echo "[opphub-update] 1. 跑 curl -fsSL https://api.opphub.ruiplus.cn/install/skill.sh | bash"
echo "[opphub-update] 2. git -C $SKILL_DIR pull (如果你 clone 的)"Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
Badge
Markdown
[](https://sigilsec.ai/scans/A8314F0F-ED11-479C-BF24-7F1DBDA768EA)HTML
<a href="https://sigilsec.ai/scans/A8314F0F-ED11-479C-BF24-7F1DBDA768EA"><img src="https://sigilsec.ai/badge/clawhub/opphub" alt="Sigil Scan"></a>Run This Scan Yourself
Scan your own packages
Run Sigil locally to audit any package before it touches your codebase.
Sigil Pro
Cloud scanning, AI investigation, web dashboard, and CI/CD integration. 14-day free trial.
Start free trial →Get threat intelligence and product updates
Security research, new threat signatures, and product updates. No spam.
Other clawhub scans
Believe this result is incorrect? Request a review or see our Terms of Service and Methodology.