Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
Review
aliyun-ai-guardrail
Global fetch interception not declared
Manual upload Apr 3, 2026
Open Report ↗
Review
capability-evolver-zc
Undeclared shell command execution throughout codebase
Manual upload Apr 3, 2026
Open Report ↗
Review
update-approval-guard (primary) + instreet + 25+ sub-skills (workspace)
Live InStreet API Key Stored in Plaintext
Manual upload Apr 3, 2026
Open Report ↗
Review
claw-office-report
Undisclosed data exfiltration — full task text sent to external server
Manual upload Apr 3, 2026
Open Report ↗
Review
ClawSafe AI Skills Portfolio
Hardcoded API key in ClawHub monitoring tool
Manual upload Apr 3, 2026
Open Report ↗
Review
openclaw-cursor-agent
Dangerous curl|bash pattern in documentation
Manual upload Apr 3, 2026
Open Report ↗
Review
memex
Hidden Telemetry with Evasion-Intent Comment
Manual upload Apr 3, 2026
Open Report ↗
Review
token-watchdog
Undeclared Shell Execution via execSync
Manual upload Apr 3, 2026
Open Report ↗
Review
whale-alert-monitor
Hardcoded billing API key in payment.py
Manual upload Apr 3, 2026
Open Report ↗
Review
clawhub-security-scan
Hardcoded high-entropy string contradicts security advice
Manual upload Apr 3, 2026
Open Report ↗
Review
claw-body
Undeclared shell execution via execSync
Manual upload Apr 3, 2026
Open Report ↗
Review
odds-movement-monitor
Hardcoded Billing API Key
Manual upload Apr 3, 2026
Open Report ↗
Review
swarm-control-feishu
Dangerous curl|bash pattern in documentation
Manual upload Apr 3, 2026
Open Report ↗
Review
seedance-creator
Remote script execution via curl|bash
Manual upload Apr 3, 2026
Open Report ↗
Review
feishu-mcp
硬编码凭证泄露
Manual upload Apr 3, 2026
Open Report ↗
Review
varg-ai
远程脚本管道执行提示
Manual upload Apr 3, 2026
Open Report ↗