ClawAudit verdict
red-alert
Accesses credentials AND makes external network calls
This skill queries two declared public/semi-public APIs (redalert.orielhaim.com and tzevaadom.co.il) for Israeli emergency alert data; the API key is optional and only used for real-time socket authentication, matching the stated purpose.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but ClawAudit detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Accesses credentials AND makes external network calls — potential credential theft
LLM02 · ASI03
Permission integrity
network_out
credential_access
package_install
Findings (4)
Pipe-to-python pattern — remote code execution risk
scripts/status.sh · prose · downgraded · curl -s -H "Accept: application/json" "https://redalert.orielhaim.com/api/status
Pipe to python — executes piped content as Python code
scripts/status.sh · prose · downgraded · | python3
Accesses sensitive environment variables
references/ENDPOINTS.md · prose · downgraded · process.env.RED_ALERT_API_KEY
Uses XMLHttpRequest — network access
scripts/package-lock.json · prose · downgraded · xmlhttprequest
Permissions & capabilities
No declared permissions — minimal attack surface.
credential_accesspackage_installnetwork_outnetwork_in Thanks — recorded.