1803eligible findings
11rule/source strata
39selected samples
Not measuredpublishable precision

Stratified cohort

STATIC_CREDENTIAL_EXFILTRATION_CHAINclawhub2 selected / 2 eligible
STATIC_DESTRUCTIVE_ROOT_COMMANDclawhub4 selected / 16 eligible
STATIC_DOWNLOAD_PIPE_TO_SHELLclawhub4 selected / 902 eligible
STATIC_DOWNLOAD_PIPE_TO_SHELLgithub4 selected / 7 eligible
STATIC_DYNAMIC_CODE_EXECUTIONclawhub4 selected / 371 eligible
STATIC_DYNAMIC_CODE_EXECUTIONgithub3 selected / 3 eligible
STATIC_OBFUSCATED_EXECUTIONclawhub4 selected / 149 eligible
STATIC_OBFUSCATED_EXECUTIONgithub4 selected / 11 eligible
STATIC_SENSITIVE_CREDENTIAL_ACCESSclawhub4 selected / 318 eligible
STATIC_SENSITIVE_CREDENTIAL_ACCESSgithub2 selected / 2 eligible
STATIC_SENSITIVE_FILE_IN_PACKAGEclawhub4 selected / 22 eligible

Sample audit list

mcp-best-practicesSTATIC_CREDENTIAL_EXFILTRATION_CHAIN · clawhubreferences/security-auth.md:172 · unlabelled
rafter-securitySTATIC_CREDENTIAL_EXFILTRATION_CHAIN · clawhubSKILL.md:160 · unlabelled
ai-companySTATIC_DESTRUCTIVE_ROOT_COMMAND · clawhubtests/test-method-patterns.py:335 · unlabelled
AgentGuardSTATIC_DESTRUCTIVE_ROOT_COMMAND · clawhubSKILL.md:603 · unlabelled
zhongkui-skillSTATIC_DESTRUCTIVE_ROOT_COMMAND · clawhubreferences/behavioral-emulation.md:76 · unlabelled
CrustdataSTATIC_DOWNLOAD_PIPE_TO_SHELL · clawhubSKILL.md:58 · unlabelled
DACHSERSTATIC_DOWNLOAD_PIPE_TO_SHELL · clawhubSKILL.md:57 · unlabelled
Google CalendarSTATIC_DOWNLOAD_PIPE_TO_SHELL · clawhubSKILL.md:92 · unlabelled
Xodo SignSTATIC_DOWNLOAD_PIPE_TO_SHELL · clawhubSKILL.md:63 · unlabelled
boltz-cli-setupSTATIC_DOWNLOAD_PIPE_TO_SHELL · githubreferences/sandbox.md:24 · unlabelled
code-reviewSTATIC_DOWNLOAD_PIPE_TO_SHELL · githubSKILL.md:24 · unlabelled
zwjh-skillSTATIC_DYNAMIC_CODE_EXECUTION · clawhubscripts/setup.py:49 · unlabelled
sandbox-sdkSTATIC_DYNAMIC_CODE_EXECUTION · githubSKILL.md:109 · unlabelled
claude-apiSTATIC_DYNAMIC_CODE_EXECUTION · githubSKILL.md:517 · unlabelled
google-docsSTATIC_DYNAMIC_CODE_EXECUTION · githubhost/docs-dropdown-file-bridge.mjs:41 · unlabelled
Skill AuditorSTATIC_OBFUSCATED_EXECUTION · clawhubscripts/score.py:98 · unlabelled
skill-installSTATIC_OBFUSCATED_EXECUTION · clawhubreferences/security_scan_prompt.md:26 · unlabelled
Risk GuardSTATIC_OBFUSCATED_EXECUTION · clawhubscripts/diagnose.py:3 · unlabelled
google-slidesSTATIC_OBFUSCATED_EXECUTION · githubhost/read-template-to-file.mjs:68 · unlabelled
produceSTATIC_OBFUSCATED_EXECUTION · githubhelpers/moodboards/assets/mood-board-app/app.js:403 · unlabelled
claude-apiSTATIC_OBFUSCATED_EXECUTION · githubSKILL.md:457 · unlabelled
rust-devSTATIC_SENSITIVE_CREDENTIAL_ACCESS · clawhubreferences/dev-environment.md:55 · unlabelled
Tinker LinkedInSTATIC_SENSITIVE_CREDENTIAL_ACCESS · clawhubscripts/linkedin.mjs:836 · unlabelled
claude-apiSTATIC_SENSITIVE_CREDENTIAL_ACCESS · githubshared/evals/report/runner-scaffold.mjs:112 · unlabelled
claude-apiSTATIC_SENSITIVE_CREDENTIAL_ACCESS · githubshared/evals/report/build-report-lite.mjs:28 · unlabelled
AnySearchSTATIC_SENSITIVE_FILE_IN_PACKAGE · clawhub.env.example · unlabelled
botlearnSTATIC_SENSITIVE_FILE_IN_PACKAGE · clawhubtemplates/credentials.json · unlabelled

Interpretation boundary