Changelog

The analysis engine now reads JavaScript and TypeScript, so a skill's Node scripts get the same data-flow analysis and evidence chains as its shell and Python code.

• JavaScript / TypeScript front end. Downloaded code run with eval, new Function, vm or a downloaded require(); the whole process.env or a credential file sent in a request, socket write or DNS lookup; base64 and character-code payloads, decoded and analysed in turn. Works on .js/.ts files, js code blocks in Markdown and node -e.
• Commands judged once, the same way. A child_process command is rebuilt and handed to the shell analysis, so execSync(`curl ${u} | sh`) is caught like the shell line, and a fetched value used as a git argument is not called remote code execution.

• An official installer (Google Cloud SDK, uv) could block a skill when the same file had an unrelated warning. Info findings now stay info.
• A pattern finding that an engine finding already explains is merged into it: about 1,700 fewer duplicate findings across the benchmark sets, same verdicts.

• JavaScript front end: 2 more malicious skills blocked, no new false alarms. All benchmarks now run with Husk's full dependencies; re-measured, 1.5.0's published numbers are unchanged.

Husk now has an analysis engine that models what code does rather than what it looks like. It follows data from where it came from (a download, a credential file, a base64 decode) to where it goes (an interpreter, the network, a startup file) through shell and Python, including code inside Markdown. Every finding comes with the lines that prove it.

• The analysis engine. bash <(curl ...), sh -c "$(curl ...)", eval "$(curl ...)", a download saved and run three code blocks later, exec(urlopen(...).read()) in Python: one finding, because they do the same thing. Six rules: credentials sent out, downloads installed to run at login, downloaded code executed, downloaded data spliced into code, decoded data executed or persisted.
• Evidence chains. husk explain shows each step, e.g. line 2 fetches https://... → line 2 saves it to /tmp/p → line 3 runs /tmp/p with sh.
• Rules as data. husk rules -v lists and explains them. Add your own with HUSK_RULES=team.yml and check a file with husk rules --check. Custom rules are part of the attested ruleset.

• SkillTrustBench malware blocked: 50.7% → 59.9%. MalSkillBench: 45.5% → 48.2%. False alarms unchanged, and 248 of 249 hand-checked legitimate skills still pass.
• Three ideas were measured and dropped because they cost more malware catches than they saved false alarms. Details in docs/ENGINE.md.

• Remote execution in shapes other than curl | bash blocks, a paste-site link next to "run" counts as an instruction, and three false positives on Anthropic's own skills are fixed.

A second evasion review found that a download-and-run payload only had to avoid the exact shape curl ... | bash on one line. Every variant it found is now blocked.

• Remote code execution in any common shape now blocks: wget | sh, curl | sudo bash, curl | python3 -, a pipe split across lines, bash <(curl ...), sh -c "$(curl ...)", eval "$(curl ...)", here-strings, downloading to /tmp and running it, Python exec() of a network read, JS fetch().then(eval), prose telling the reader to pipe a URL into bash, and any of these base64-encoded. Official installers (rustup, uv, Docker, NodeSource and others) stay info-only.
• A paste-site URL next to "run" or "execute" now counts as an instruction to run it, and seven more paste sites are recognised.

• Three false positives on Anthropic's own skills: "an eval (prompt tuning...)" read as eval(, a sentence describing a supersede claim, and a long comment in an HTML template.

• 36 more MalSkillBench malware samples blocked, no change in benign false alarms, and 248 of 249 hand-checked legitimate skills clean again.
• The competitor head-to-head was re-run with Cisco skill-scanner 2.2.2, SecureAI-Scan 0.12.0 and agent-audit-kit 0.6.20. Husk still blocks the most malware; the only scanner with as few false alarms, SecureAI-Scan, catches about a third as much. Full tables in BENCHMARK.md.

A security review found ways to make husk gate pass a skill that ships a plain curl | bash payload. All of them are closed, and each has a regression test.

• A skill can no longer relax its own gate. A .huskpolicy or .huskignore inside the package being checked can make the gate stricter, but its ignore list, example paths and looser thresholds only apply with --trust-package-policy (for your own repository) or when passed explicitly with --policy / --suppress. The GitHub Action has a matching trust-package-policy input, off by default.
• Instructions to extract an archive with a given password, the most common real-world dropper, now block instead of warn. That catches 5.9 points more MalSkillBench malware and 3.7 points more SkillTrustBench malware, with no new blocks on benign skills.
• husk aggregate exits non-zero whenever any source flags the skill or Husk couldn't scan it.

• Files Husk never looked at are now scanned: extensionless scripts, Makefiles, .mjs/.cjs, shell variants, Perl, PHP, Lua, PowerShell modules, VBScript, HTML, anything else that is text by content, and UTF-16/UTF-32 files.
• .tar, .tar.gz and .gz files are unpacked with the same limits as zip. Bundled pickles are checked, 7z/rar are reported as not inspected, and shipped .pyc bytecode blocks (the PyCache Trap technique, arXiv:2610.10612).
• Encrypted, corrupt or crafted archives and any file that crashes the scanner are reported as findings instead of aborting the scan.
• curl | bash detection can't be dodged with a negating word in an unrelated comment, a trusted installer earlier on the same line, or 500 trusted lines filling the rule's cap.
• Attestations, the scan cache, husk watch and husk crossref now hash every file in a skill, not only text files, so a swapped bundled archive is no longer missed.
• On Windows, a skill fetched from GitHub could write outside its temp folder.
• The GitHub Action no longer pastes its inputs into shell scripts, and pinning the action now pins the scanner too.

• The dynamic sandbox killed every Go binary, couldn't find node or ruby outside /usr/bin, and let forked processes outlive a run.
• ClawHub verdicts fall back to its public /verify endpoint (set CLAWHUB_TOKEN if you have one).

• Results on SkillTrustBench (5,520 skills): 90.7% of malicious skills flagged, 50.7% blocked outright, 1.7% of normal skills blocked. Reproducible with benchmarks/dataset_bench.py.
• CI on Python 3.9 to 3.14, green again.

• The trusted-installer allowlist matched a substring of the URL, so a malicious curl | bash could be demoted to a harmless note by mentioning a trusted name anywhere in it (evil.com/?x=astral.sh, astral.sh.evil.com, notbun.sh, astral.sh@evil.com). The real hostname is now parsed and must match exactly.

• New detections for blind spots found in the head-to-head benchmark, each measured on the full 11,225 malicious / 4,249 legitimate datasets before being added: persistence through the Windows Startup folder or scheduled tasks, code that appends to shell startup files, skills that describe establishing persistence, filesystem hunts for credential files (.env, SSH keys, .pem), and code that downloads something and then imports or runs it. Plain downloads stay unflagged.
• Skills that re-download their own instructions into a skills folder get an informational note (not a flag: many legitimate skills do this).
• Lookups work for skills inside very large repositories: when a repository is too big to download whole, only the skill's own folder is fetched. Set GITHUB_TOKEN for a higher GitHub API limit.
• A head-to-head benchmark against 16 other skill scanners, every tool on the same fixed sample (see BENCHMARK.md).
• CI on Python 3.9-3.13, and releases published automatically from a version tag.

• Husk failed on Python 3.9 and 3.10 (a pattern used in 1.3.4's hardening needs 3.11). Rewritten to work everywhere, with the same protection against slow-matching input.
• skills.sh lookups failed ("No verdict") for skills that live in a subfolder of their repository, such as skills/<name>/.

• Scanning is now linear-time on hostile input. Eight regexes with catastrophic backtracking were anchored and bounded, per-match line counting now uses a cached index, and context look-backs are capped. 200 KB of crafted text used to take over a minute; the worst case at 512 KB is now a few seconds.
• Each detection rule stops after 500 hits, so a file repeating one pattern thousands of times can't burn CPU.
• Skills fetched from GitHub are capped at 50 MB expanded and 5,000 files (a 0.25 MB tarball could previously write 252 MB).
• Nested archives in one scan share a single size budget. scan_package and aggregate_skill_opinions accept a byte budget for hosted use.
• Downloaded skills are deleted after a lookup instead of being left in temp storage, including failed ClawHub lookups and skills that sit in a subfolder of the download.

• Archives inside a skill are now unpacked with hard limits (50 MB expanded, 5,000 files, no paths outside the target folder). A nested zip bomb is reported as a finding instead of being extracted.
• Skills fetched from GitHub are downloaded with a 30 MB cap instead of being read fully into memory.

• skills.sh and agentskill.sh audit verdicts showed as unavailable: the parsers were matched against cleaned text rather than the raw HTML the server receives. They now strip tags first.

• agentskill.sh skill lookup: the install API URL was %2F-encoded and 404'd on

Marketplace lookup actually works for all three registries, plus each marketplace's own audit verdict.

• skills.sh and agentskill.sh skill lookup now resolve real content (was

• skills.sh and agentskill.sh native audit verdicts: alongside Husk's own scan,

Multi-language depth, PDF coverage, and the false-positive fixes that a real ecosystem scan of live GitHub skills exposed.

• AST-based JS/TS taint engine (esprima): real source->assignment->sink
• PDF text extraction: bundled PDFs are extracted and run through the full
• Ecosystem research harnesses (benchmarks/): mass-scan live marketplace

• Office/container formats (.docx, .xlsx, .pptx, .jar, .whl, .ipynb, fonts...)
• A bare http(s):// URL no longer counts as a data-movement "action" in the
• The newest attack types (reverse shells, OAST/exfil beacons, bulk env
• Duplicate findings are deduped in scan_package.

Husk becomes a lifecycle security layer, not just a scanner. Three new capabilities, each doing something a point-in-time / server-side AI review structurally cannot.

• husk attest / husk verify-attestation - deterministic, content-bound
• husk crossref - cross-marketplace verification. Fetches the same skill
• husk watch - re-scans installed skills against a local baseline and
• husk explain - explainable data-flow: the exact source -> variable ->
• husk registry + content-addressed scan cache - scan many skills (a
• Real AST-based JS/TS taint engine (esprima) - Husk now follows data flow
• PDF text extraction - bundled PDFs are extracted and run through the full
• Detection: two no-code prose prompt-injection classes now caught

• New rules from a systematic miss analysis: out-of-band exfil-testbed callback

Focus: precision (making Husk trustworthy on real skills) and adoption (making it something a registry can actually drop into CI).

• husk gate <package>: a deterministic pre-publish gate - one PASS/WARN/FAIL
• .huskpolicy file: per-package policy (block_on / warn_on / ignore /
• GitHub Action rebuilt around the gate: severity-based pass/fail, PR comment

• Proximity requirement added to the identity-file, wallet, and credential-
• Trusted-installer allowlist: curl | bash from a reputable vendor endpoint
• Bare-IP rule excludes bind-all/placeholder/doc IPs (0.0.0.0, 1.2.3.4, RFC
• Net result: benign skills correctly cleared 92.2% -> 95.4%, curated real

From the second live ClawHub run (600 skills, 0 download errors).

• "File references a credential-file pattern" is an INFO note in documentation

• ClawHub's own verdict was "unavailable" for skills whose name is shared by

• The ClawHub benchmark records ClawHub's reason codes and summarises why

Found by running Husk against 452 real ClawHub skills (benchmarks/clawhub_benchmark.py).

• A file containing null bytes crashed the whole package scan.
• ClawHub lookups failed for skills whose name is shared by several publishers

• "Unusually long hidden comment" is now an INFO note unless the comment is

• benchmarks/clawhub_benchmark.py: compares Husk with ClawHub's published

• husk crashed on launch on Windows: the Unix-only resource module was
• ClawHub lookups never worked in production. The integration shelled out

• Five new checks from a held-out re-benchmark (see BENCHMARK.md, "v1.1.1"):
• Recall: MalSkillBench 63.9% -> 64.6%, ASB 61.9% -> 63.5% (held-out halves

• husk aggregate now scans the whole downloaded package, not only
• Lookup failures now explain themselves (unknown skill, rate limit,
• Results link back to the canonical ClawHub listing, as ClawHub's API terms ask.
• Accepts slug, owner/slug, @owner/slug or a clawhub.ai URL.
• The unbuilt Socket adapter is no longer shown as a checked source.

• SARIF 2.1.0 output (husk package <path> --output report.sarif),
• .huskignore finding suppression, same convention as .gitignore.
• Official GitHub Action (ctrl-adam/Husk/action@main) wrapping scan
• Package-level LLM semantic review (husk package --llm-review) -
• Multi-provider LLM consensus review (--llm-consensus) - queries
• LLM review response caching and retry-with-backoff on transient API
• VirusTotal signature check (husk package --virustotal) for the one
• AST-based taint tracking now follows multi-hop parameter reassignment
• 8 new detection modules found and hardened against
• Detection for the SkillCloak evasion technique (arXiv:2607.02357) -
• husk aggregate <skill_ref> --marketplace {clawhub,skillssh,agentskillsh} -

• Relicensed MIT -> AGPL-3.0-or-later. See README.md's own License
• Confidence tiering: some findings (e.g. an ambiguous credential-file
• Real-world recall: 63.9% (MalSkillBench) / 61.3% (ASB-derived),

• Several real false positives found via testing against the full

First public releases: the core detection engine, package/archive and pickle-model scanning, the optional sandbox and LLM-review layers, and the dual-dataset benchmark.