Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
Review
ClawSafe AI Skills Portfolio
Hardcoded API key in ClawHub monitoring tool
Manual upload Apr 3, 2026
Open Report ↗
Review
openclaw-cursor-agent
Dangerous curl|bash pattern in documentation
Manual upload Apr 3, 2026
Open Report ↗
Review
memex
Hidden Telemetry with Evasion-Intent Comment
Manual upload Apr 3, 2026
Open Report ↗
High Risk
superguard
Hidden garbled text in metadata likely containing prompt injection
Manual upload Apr 3, 2026
Open Report ↗
High Risk
agent-p2p
Hardcoded default password for admin backend
Manual upload Apr 3, 2026
Open Report ↗
High Risk
async-command
Hardcoded External IP Address
Manual upload Apr 3, 2026
Open Report ↗
Review
token-watchdog
Undeclared Shell Execution via execSync
Manual upload Apr 3, 2026
Open Report ↗
Review
whale-alert-monitor
Hardcoded billing API key in payment.py
Manual upload Apr 3, 2026
Open Report ↗
Review
clawhub-security-scan
Hardcoded high-entropy string contradicts security advice
Manual upload Apr 3, 2026
Open Report ↗
Review
claw-body
Undeclared shell execution via execSync
Manual upload Apr 3, 2026
Open Report ↗
High Risk
ai-redaction
Obfuscated compiled JavaScript hides functionality
Manual upload Apr 3, 2026
Open Report ↗
Review
odds-movement-monitor
Hardcoded Billing API Key
Manual upload Apr 3, 2026
Open Report ↗
Review
swarm-control-feishu
Dangerous curl|bash pattern in documentation
Manual upload Apr 3, 2026
Open Report ↗
Review
seedance-creator
Remote script execution via curl|bash
Manual upload Apr 3, 2026
Open Report ↗
High Risk
gitlab
Hardcoded GitLab API Token
Manual upload Apr 3, 2026
Open Report ↗
High Risk
income-lab
Hardcoded API Key Exposed in Source Code
Manual upload Apr 3, 2026
Open Report ↗