中文 EN
Start Review
Risk Sample Stream

Which skills recently failed
or triggered trust review

This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.

610 Risky samples surfaced
0 New in 7 days
0 Platform misses surfaced
All Malicious High Risk Suspicious
Sort by time Sort by risk
All Code Exec Credential Theft Data Exfil Priv Esc Supply Chain Doc Deception Prompt Injection Obfuscation
65 /100
Trust
Review

xhs-fav-export

wc3-code.mjs 高度代码混淆且未声明

ObfuscationDoc Mismatch
ClawHub 23 days ago
Open Report ↗
62 /100
Trust
Review

smyx-pet-grooming-stress-behavior-analysis

静默用户自动注册

Doc MismatchCredential TheftObfuscationSensitive Access
ClawHub 23 days ago
Open Report ↗
55 /100
Trust
Review

chrome-use

未版本锁定的远程脚本执行

Supply ChainDoc Mismatch
ClawHub 24 days ago
Open Report ↗
45 /100
Trust
Review

mcp-server-builder

SKILL.md与skill-card.md声明冲突

Doc MismatchSupply ChainCredential Theft
ClawHub 24 days ago
Open Report ↗
60 /100
Trust
Review

smyx-pet-oral-snapshot-gum-redness-analysis

Network communication not declared in SKILL.md

Doc MismatchPriv EscalationSensitive Access
ClawHub 26 days ago
Open Report ↗
55 /100
Trust
Review

elevenlabs-toolkit

未声明的 Mistral API 集成（阴影功能）

Doc MismatchSupply Chain
ClawHub 26 days ago
Open Report ↗
55 /100
Trust
Review

backlog

Undeclared K3s/kubectl shell execution

Doc MismatchObfuscationSensitive AccessPriv Escalation
ClawHub 26 days ago
Open Report ↗
58 /100
Trust
Review

weread-fulltext

文档声明「零注入」但实际使用 page.evaluate() 执行 JS

Doc MismatchSupply ChainPriv Escalation
ClawHub 26 days ago
Open Report ↗
55 /100
Trust
Review

migu-ai-creative-photo

User-Agent 版本号格式异常

ObfuscationSensitive AccessCredential Theft
ClawHub 27 days ago
Open Report ↗
58 /100
Trust
Review

astraflow-remote-lab

沙箱内进程管理未声明

Doc MismatchObfuscationPersistence
ClawHub 29 days ago
Open Report ↗
55 /100
Trust
Review

elderly-fall-detection-analysis

注释代码中存在未声明的远程执行能力

Doc MismatchCredential TheftSupply ChainPriv Escalation
ClawHub 29 days ago
Open Report ↗
55 /100
Trust
Review

smyx-elderly-medication-compliance-analysis

影子凭证收集机制

Credential TheftSensitive AccessData ExfilSupply Chain
ClawHub 29 days ago
Open Report ↗
55 /100
Trust
Review

浙江企业工商信息查询（按名核验）

硬编码IP绕过DNS透明度

Sensitive AccessData ExfilCredential Theft
ClawHub Sep 25, 2026
Open Report ↗
58 /100
Trust
Review

dlazy-text-storyboard-script

主体功能描述与执行指南存在声明-行为不一致

Doc MismatchSupply ChainPriv EscalationSensitive Access
ClawHub Sep 24, 2026
Open Report ↗
58 /100
Trust
Review

xreply

远程 npm 包代码不可审查

Supply ChainDoc Mismatch
ClawHub Sep 23, 2026
Open Report ↗
48 /100
Trust
Review

浙江供应商资质业绩核验

声明与实际网络协议不符

Doc MismatchData ExfilSupply Chain
ClawHub Sep 23, 2026
Open Report ↗
← Previous
2 / 24
Next →