中文 EN
Start Review
Risk Sample Stream

Which skills recently failed
or triggered trust review

This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.

610 Risky samples surfaced
0 New in 7 days
0 Platform misses surfaced
All Malicious High Risk Suspicious
Sort by time Sort by risk
All Code Exec Credential Theft Data Exfil Priv Esc Supply Chain Doc Deception Prompt Injection Obfuscation
65 /100
Trust
Review

plori

Shell管道安装命令存在供应链风险

Supply ChainPriv Escalation
ClawHub 9 days ago
Open Report ↗
60 /100
Trust
Review

peen

远程脚本管道执行

RCESupply ChainPriv Escalation
ClawHub 10 days ago
Open Report ↗
52 /100
Trust
Review

jira-toolkit-free

文档嵌入凭证收割命令模板

Credential TheftDoc MismatchSupply ChainPriv Escalation
ClawHub 16 days ago
Open Report ↗
35 /100
Trust
High Risk

self-evolution-engine

硬编码API密钥泄露

Credential TheftDoc MismatchPriv EscalationSupply Chain
ClawHub 16 days ago
Open Report ↗
55 /100
Trust
Review

smyx-driver-flushing-sweat-detection-analysis

视频数据上传外部云服务未声明

Doc MismatchCredential TheftData ExfilSupply Chain
ClawHub 18 days ago
Open Report ↗
65 /100
Trust
Review

odds-movement-monitor-v2026

计费系统未在SKILL.md中声明

Doc MismatchSupply ChainPriv Escalation
ClawHub 19 days ago
Open Report ↗
55 /100
Trust
Review

dlazy-webtoon-adapter

Shell execution capability not declared in SKILL.md

Doc MismatchPriv EscalationSupply Chain
ClawHub 21 days ago
Open Report ↗
52 /100
Trust
Review

stratpit

文档声明与实际能力存在关键矛盾

Doc MismatchSupply ChainCredential TheftPriv Escalation
ClawHub 21 days ago
Open Report ↗
55 /100
Trust
Review

demo-text-summarizer

SKILL.md 未声明的发布功能

Doc MismatchCredential TheftPriv EscalationSupply Chain
ClawHub 21 days ago
Open Report ↗
55 /100
Trust
Review

agent-guardian

apply-qqbot-patch.sh 通过 sed 注入 execSync 修改第三方插件

RCEPersistenceSupply ChainSensitive Access
ClawHub 22 days ago
Open Report ↗
35 /100
Trust
High Risk

precc

curl|bash 远程脚本执行 — 等效供应链攻击

Supply ChainRCEPriv EscalationDoc Mismatch
ClawHub 25 days ago
Open Report ↗
62 /100
Trust
Review

wenzi-runse

硬编码API密钥于源码中

Supply ChainData ExfilCredential TheftPriv Escalation
ClawHub 25 days ago
Open Report ↗
60 /100
Trust
Review

smyx-pet-oral-snapshot-gum-redness-analysis

Network communication not declared in SKILL.md

Doc MismatchPriv EscalationSensitive Access
ClawHub 26 days ago
Open Report ↗
55 /100
Trust
Review

backlog

Undeclared K3s/kubectl shell execution

Doc MismatchObfuscationSensitive AccessPriv Escalation
ClawHub 26 days ago
Open Report ↗
58 /100
Trust
Review

weread-fulltext

文档声明「零注入」但实际使用 page.evaluate() 执行 JS

Doc MismatchSupply ChainPriv Escalation
ClawHub 26 days ago
Open Report ↗
55 /100
Trust
Review

elderly-fall-detection-analysis

注释代码中存在未声明的远程执行能力

Doc MismatchCredential TheftSupply ChainPriv Escalation
ClawHub 29 days ago
Open Report ↗
1 / 11
Next →