中文 EN
Start Review
Risk Sample Stream

Which skills recently failed
or triggered trust review

This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.

610 Risky samples surfaced
0 New in 7 days
0 Platform misses surfaced
All Malicious High Risk Suspicious
Sort by time Sort by risk
All Code Exec Credential Theft Data Exfil Priv Esc Supply Chain Doc Deception Prompt Injection Obfuscation
35 /100
Trust
High Risk

precc

curl|bash 远程脚本执行 — 等效供应链攻击

Supply ChainRCEPriv EscalationDoc Mismatch
ClawHub 25 days ago
Open Report ↗
62 /100
Trust
Review

wenzi-runse

硬编码API密钥于源码中

Supply ChainData ExfilCredential TheftPriv Escalation
ClawHub 25 days ago
Open Report ↗
55 /100
Trust
Review

elevenlabs-toolkit

未声明的 Mistral API 集成（阴影功能）

Doc MismatchSupply Chain
ClawHub 26 days ago
Open Report ↗
58 /100
Trust
Review

weread-fulltext

文档声明「零注入」但实际使用 page.evaluate() 执行 JS

Doc MismatchSupply ChainPriv Escalation
ClawHub 26 days ago
Open Report ↗
55 /100
Trust
Review

elderly-fall-detection-analysis

注释代码中存在未声明的远程执行能力

Doc MismatchCredential TheftSupply ChainPriv Escalation
ClawHub 29 days ago
Open Report ↗
55 /100
Trust
Review

smyx-elderly-medication-compliance-analysis

影子凭证收集机制

Credential TheftSensitive AccessData ExfilSupply Chain
ClawHub 29 days ago
Open Report ↗
58 /100
Trust
Review

dlazy-text-storyboard-script

主体功能描述与执行指南存在声明-行为不一致

Doc MismatchSupply ChainPriv EscalationSensitive Access
ClawHub Sep 24, 2026
Open Report ↗
58 /100
Trust
Review

xreply

远程 npm 包代码不可审查

Supply ChainDoc Mismatch
ClawHub Sep 23, 2026
Open Report ↗
60 /100
Trust
Review

smyx-pet-oral-snapshot-gum-redness-analysis

隐藏参数未在SKILL.md声明

Doc MismatchData ExfilSensitive AccessSupply Chain
ClawHub Sep 23, 2026
Open Report ↗
48 /100
Trust
Review

浙江供应商资质业绩核验

声明与实际网络协议不符

Doc MismatchData ExfilSupply Chain
ClawHub Sep 23, 2026
Open Report ↗
55 /100
Trust
Review

session-notebook

会话转录文件全文上传至外部端点

Data ExfilDoc MismatchSensitive AccessSupply Chain
ClawHub Sep 23, 2026
Open Report ↗
62 /100
Trust
Review

expert-audit-pub

文档声称本地运行，实际包含远程 API 调用

Doc MismatchPriv EscalationSupply ChainSensitive Access
ClawHub Sep 22, 2026
Open Report ↗
65 /100
Trust
Review

guaikei-video-to-script

文档承诺与实际行为不符

Doc MismatchSupply Chain
ClawHub Sep 21, 2026
Open Report ↗
58 /100
Trust
Review

oo-docsumo

Remote script execution via curl|bash

Supply ChainDoc Mismatch
ClawHub Sep 20, 2026
Open Report ↗
55 /100
Trust
Review

oo-telegram

安装命令超出 allowed-tools 声明范围

Priv EscalationSupply ChainDoc Mismatch
ClawHub Sep 20, 2026
Open Report ↗
50 /100
Trust
Review

audit-adjustment-check-free

SKILL.md声明与实际网络行为不符

Doc MismatchSensitive AccessSupply Chain
ClawHub Sep 19, 2026
Open Report ↗
← Previous
2 / 17
Next →