clawsay
Warn
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Detected suspicious dependency 'termcolor3' in 'scripts/pyproject.toml' and 'scripts/uv.lock'. The package appears to shadow the well-known 'termcolor' library, which is a common technique for malicious packages. The 'uv.lock' file indicates an unusually small package size (683 bytes) and an anomalous future upload date (2026), both of which are significant red flags for malicious or placeholder content.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection in 'scripts/clawsay.py' because it processes untrusted input. Ingestion points: User input message is captured via command-line arguments in 'sys.argv'. Boundary markers: Absent; the user-provided text is placed directly into the speech bubble without delimiters. Capability inventory: The script's capabilities are limited to console output (printing). Sanitization: Absent; the input is used directly without validation or escaping, which could influence downstream agents reading the output.
Audit Metadata