https://clawhub.ai/api/v1/skills/engram-brain/file?path=SKILL.md&version=0.3.4
github.com/clawhub.ai/engram-brain
Scanned Thu, 28 May 2026 16:33:33 GMT
Scan ID crawl-bz067mkdw336sne9niuxa8pv · 8ms
C
SCORE 55 / 100
Verdict: Proceed with caution

3 high-severity findings.

This skill runs unsafe shell commands plus 3 other issues listed below.

0 critical3 high1 medium8 rules passed

Why grade C?

score · 55 / 100

The current grade reflects 3 high-severity findings (3+ HIGHs → C).

0 CRIT3 HIGH1 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 1 of 3 HIGH (cap is 2).

  • A
    Reach Atarget score 95

    Resolve all 3 HIGH.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

high
Dangerous shell pattern: curl | shell
The skill contains a shell command pattern (`curl | shell`) commonly used in destructive or supply-chain attacks.
rule: dangerous-shellline: 7CWE-78
▾
5homepage: https://github.com/Moshik21/engram
6user-invocable: true
7metadata: {"openclaw":{"requires":{"anyBins":["curl"]},"envVars":[{"name":"ANTHROPIC_API_KEY","required":false,"description":"Optional richer entity extraction; deterministic extraction works without it."},{"name":"ENGRAM_GROUP_ID","required":false,"description":"Optional brain namespace for multi-brain setups."}],"emoji":"\ud83e\udde0","homepage":"https://github.com/Moshik21/engram","install":[{"kind":"shell","command":"curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- openclaw","bins":["engram","engramctl"]}],"tags":["memory","knowledge-graph","mcp","recall","long-term-memory","cognitive-architecture"]}}← curl | shell — common in destructive or supply-chain attacks
8---
9
high
Dangerous shell pattern: curl | shell
The skill contains a shell command pattern (`curl | shell`) commonly used in destructive or supply-chain attacks.
rule: dangerous-shellline: 31CWE-78
▾
29
30```bash
31curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- openclaw← curl | shell — common in destructive or supply-chain attacks
32```
33
high
Dangerous shell pattern: curl | shell
The skill contains a shell command pattern (`curl | shell`) commonly used in destructive or supply-chain attacks.
rule: dangerous-shellline: 74CWE-78
▾
72
73```bash
74curl -sSL https://raw.githubusercontent.com/Moshik21/engram/main/scripts/install.sh | bash -s -- full← curl | shell — common in destructive or supply-chain attacks
75```
76
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-bz067mkdw336sne9niuxa8pv