Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
Review
Novai360 智能市场分析
Undeclared network access to third-party API
Manual upload Apr 3, 2026
Open Report ↗
Review
doctor-check
API key validation method unspecified
Manual upload Apr 3, 2026
Open Report ↗
Review
xclaw-skill
Undocumented private key storage in plaintext
Manual upload Apr 3, 2026
Open Report ↗
Review
memory-compactor
Documentation-only skill with unverifiable behavior
Manual upload Apr 3, 2026
Open Report ↗
Review
onetrust
Third-party credential proxy without transparency
Manual upload Apr 3, 2026
Open Report ↗
Review
blood-pressure-therapy
Undeclared external URL references
Manual upload Apr 3, 2026
Open Report ↗
Review
PathClaw
Hardcoded External IP Address
Manual upload Apr 3, 2026
Open Report ↗
Review
authlock
Shell command injection vulnerability in --exec
Manual upload Apr 3, 2026
Open Report ↗
Review
claw-wallet
Unsigned closed-source binary execution without integrity verification
Manual upload Apr 3, 2026
Open Report ↗
Review
edge
Undeclared shell execution via npx spawn
Manual upload Apr 3, 2026
Open Report ↗
Review
skill-state-manager
Credential Harvesting Framework
Manual upload Apr 3, 2026
Open Report ↗
Review
video-to-text
Undeclared subprocess execution via execSync
Manual upload Apr 3, 2026
Open Report ↗
Review
youdaonote
Dangerous curl|bash installation pattern documented
Manual upload Apr 3, 2026
Open Report ↗
Review
bitable_to_feishu_webhook
Data exfiltration via undeclared webhook URL
Manual upload Apr 3, 2026
Open Report ↗
Review
self-evolution-engine
Hardcoded API Key
Manual upload Apr 3, 2026
Open Report ↗
Review
affiliate-skills
Remote Script Execution via Pipe-to-Shell
Manual upload Apr 3, 2026
Open Report ↗