中文 EN
Start Review
Risk Sample Stream

Which skills recently failed
or triggered trust review

This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.

610 Risky samples surfaced
0 New in 7 days
0 Platform misses surfaced
All Malicious High Risk Suspicious
Sort by time Sort by risk
All Code Exec Credential Theft Data Exfil Priv Esc Supply Chain Doc Deception Prompt Injection Obfuscation
45 /100
Trust
Review

award-contract-consistency-check-free

SKILL.md 声明不联网但实际存在外部网络请求

Doc MismatchData ExfilPriv EscalationPrompt Injection
ClawHub Sep 19, 2026
Open Report ↗
55 /100
Trust
Review

asset-disposal-check-free

文档声称离线运行但实际有网络行为

Doc MismatchData ExfilPriv EscalationSensitive Access
ClawHub Sep 19, 2026
Open Report ↗
48 /100
Trust
Review

asset-impairment-check-free

匿名标识声明与实际不符

Doc MismatchData ExfilPriv Escalation
ClawHub Sep 19, 2026
Open Report ↗
55 /100
Trust
Review

clawpi-redpacket-monitor

Undeclared JWT token extraction from wallet config

Credential TheftRCEDoc MismatchSensitive Access
ClawHub Sep 19, 2026
Open Report ↗
35 /100
Trust
Review

agent-guard

External npm package with uninspectable code

Supply ChainDoc MismatchSensitive AccessCredential Theft
ClawHub Sep 19, 2026
Open Report ↗
35 /100
Trust
High Risk

companion-skill

Safety System Bypass Instructions

Prompt InjectionDoc Mismatch
ClawHub Sep 19, 2026
Open Report ↗
38 /100
Trust
High Risk

feishu-log

Hardcoded Feishu API Credentials in Source Code

Credential TheftDoc MismatchSensitive Access
ClawHub Sep 19, 2026
Open Report ↗
58 /100
Trust
Review

购物省钱宝

Undeclared outbound HTTP call on every query

Doc MismatchSupply ChainData Exfil
ClawHub Sep 18, 2026
Open Report ↗
50 /100
Trust
Review

social-postcjo

SKILL.md 与 SKILL.md.bak 声明不一致

Doc MismatchCredential TheftPersistenceSupply Chain
ClawHub Sep 18, 2026
Open Report ↗
55 /100
Trust
Review

agentkind

Dangerous curl|sh pattern in documentation

RCEDoc MismatchCredential Theft
ClawHub Sep 18, 2026
Open Report ↗
55 /100
Trust
Review

fork-latte-skill

Hardcoded API key embedded in skill files

Credential TheftPriv EscalationDoc MismatchSupply Chain
ClawHub Sep 18, 2026
Open Report ↗
25 /100
Trust
High Risk

mcp-server-builder

X402_API_KEY harvested from environment

Credential TheftData ExfilDoc MismatchSupply Chain
ClawHub Sep 18, 2026
Open Report ↗
60 /100
Trust
Review

smyx-fish-surface-symptom-detection-analysis

Undeclared local SQLite database with credential storage

Doc MismatchSensitive AccessSupply Chain
ClawHub Sep 15, 2026
Open Report ↗
55 /100
Trust
Review

ClawCode Lens

Local-only claim contradicts documented external upload path

Doc MismatchSensitive Access
ClawHub Sep 15, 2026
Open Report ↗
53 /100
Trust
Review

xhs-note-analyst (账号诊断)

Obfuscated wc3-code.mjs with undeclared data exfiltration path

ObfuscationDoc MismatchSensitive Access
ClawHub Sep 14, 2026
Open Report ↗
35 /100
Trust
High Risk

gaode-taxi

未声明的第三方代理数据中转

Data ExfilDoc MismatchCredential Theft
ClawHub Sep 14, 2026
Open Report ↗
← Previous
3 / 24
Next →