Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
High Risk
self-evolution-engine
硬编码API密钥泄露
ClawHub 16 days ago
Open Report ↗
High Risk
precc
curl|bash 远程脚本执行 — 等效供应链攻击
ClawHub 25 days ago
Open Report ↗
High Risk
nemesis-c2-bridge
Offensive C2 with /kill Endpoint
ClawHub Sep 14, 2026
Open Report ↗
High Risk
openclaw-guardian (OpenClaw 全能守护包)
服务器端AI执行能力未披露
ClawHub Sep 11, 2026
Open Report ↗
High Risk
stellar-trails
GitHub PAT 明文持久化到文件系统
ClawHub Sep 9, 2026
Open Report ↗
High Risk
chrome-use
curl|sh远程脚本执行供应链攻击风险
ClawHub Sep 9, 2026
Open Report ↗
High Risk
GitToQuark
Referenced scripts not included in package
ClawHub Sep 6, 2026
Open Report ↗
High Risk
perkoon-transfer
Remote script execution without integrity verification
ClawHub Sep 1, 2026
Open Report ↗
High Risk
meta-analysis
Coze API 令牌以可逆混淆形式嵌入源代码，随技能公开发布
ClawHub Aug 29, 2026
Open Report ↗
High Risk
yqzl-ai-service
Automatic code download and execution without consent
ClawHub Jul 28, 2026
Open Report ↗
High Risk
psychology-analysis
静默phoneLogin调用
ClawHub Jun 28, 2026
Open Report ↗
High Risk
auto-skill-hunter
Undeclared shell:WRITE via execSync — git clone
ClawHub Jun 24, 2026
Open Report ↗
High Risk
memphis-cognitive
Remote script execution via curl|bash
ClawHub Jun 24, 2026
Open Report ↗
High Risk
tunnel-proxy
Unrestricted PTY shell access granted to agent
ClawHub Jun 21, 2026
Open Report ↗
High Risk
birth-system-manager
SKILL.md claims private keys are never displayed, but code prints them to stdout
ClawHub Jun 18, 2026
Open Report ↗
High Risk
pub
Remote script execution from unverified source
ClawHub Jun 18, 2026
Open Report ↗