KCNyu/clawock
C3AI argues. Code settles. The losses stay on the page. A real HK + US brokerage account run by agents that must debate every call, settled by code the model never touches. Install the same decision wor
★ 10+ · KCNyu/clawock source on GitHub · this plugin in the registry
KCNyu/clawock is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, reads credential-class env vars.
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | cordis.patch.yml |
| reads credential-class env vars | token_env | NOSTR_PRIVATE_KEY, TAVILY_API_KEY |
Services it injects
remote slots
Outbound domains
api.tavily.com njump.me kcnyu.github.io
Environment variables it reads
NOSTR_TOOLS_PATH CHROME_EXE TAVILY_API_KEY NOSTR_RELAYS NOSTR_PRIVATE_KEY URL OUT_DIR FRAME_DIR TMP_DIR CAPTURE_GIF
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.