Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
High Risk
async-command
Hardcoded External IP Address
Manual upload Apr 3, 2026
Open Report ↗
Review
token-watchdog
Undeclared Shell Execution via execSync
Manual upload Apr 3, 2026
Open Report ↗
Review
whale-alert-monitor
Hardcoded billing API key in payment.py
Manual upload Apr 3, 2026
Open Report ↗
Review
clawhub-security-scan
Hardcoded high-entropy string contradicts security advice
Manual upload Apr 3, 2026
Open Report ↗
Review
claw-body
Undeclared shell execution via execSync
Manual upload Apr 3, 2026
Open Report ↗
High Risk
ai-redaction
Obfuscated compiled JavaScript hides functionality
Manual upload Apr 3, 2026
Open Report ↗
Review
odds-movement-monitor
Hardcoded Billing API Key
Manual upload Apr 3, 2026
Open Report ↗
Review
swarm-control-feishu
Dangerous curl|bash pattern in documentation
Manual upload Apr 3, 2026
Open Report ↗
Review
seedance-creator
Remote script execution via curl|bash
Manual upload Apr 3, 2026
Open Report ↗
High Risk
gitlab
Hardcoded GitLab API Token
Manual upload Apr 3, 2026
Open Report ↗
High Risk
income-lab
Hardcoded API Key Exposed in Source Code
Manual upload Apr 3, 2026
Open Report ↗
Review
varg-ai
远程脚本管道执行提示
Manual upload Apr 3, 2026
Open Report ↗
Review
metacomp_visionx_kyt
npx远程代码执行风险
Manual upload Apr 3, 2026
Open Report ↗
High Risk
AI Agent Skills Workspace
InStreet API Key 硬编码泄露
Manual upload Apr 3, 2026
Open Report ↗
Review
linux-cron-panel
强制下载并执行第三方仓库代码
Manual upload Apr 3, 2026
Open Report ↗
Review
mingquan-mcp
影子功能：未声明的 claw_report 遥测
Manual upload Apr 3, 2026
Open Report ↗