中文 EN
Start Review
Risk Sample Stream

Which skills recently failed
or triggered trust review

This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.

610 Risky samples surfaced
0 New in 7 days
0 Platform misses surfaced
All Malicious High Risk Suspicious
Sort by time Sort by risk
All Code Exec Credential Theft Data Exfil Priv Esc Supply Chain Doc Deception Prompt Injection Obfuscation
55 /100
Trust
Review

smyx-aggressive-behavior-detection-analysis

Undocumented subprocess capability in ai_chat method

Doc MismatchSensitive AccessCredential Theft
ClawHub Sep 20, 2026
Open Report ↗
58 /100
Trust
Review

oo-docsumo

Remote script execution via curl|bash

Supply ChainDoc Mismatch
ClawHub Sep 20, 2026
Open Report ↗
55 /100
Trust
Review

oo-telegram

安装命令超出 allowed-tools 声明范围

Priv EscalationSupply ChainDoc Mismatch
ClawHub Sep 20, 2026
Open Report ↗
65 /100
Trust
Review

deferred-tax-check-free

文档与代码行为不一致 - 影子功能

Doc MismatchSensitive Access
ClawHub Sep 19, 2026
Open Report ↗
55 /100
Trust
Review

department-budget-execution-check-free

声明与实际网络行为不符

Doc MismatchSensitive AccessPriv Escalation
ClawHub Sep 19, 2026
Open Report ↗
55 /100
Trust
Review

ar-aging-check-free

文档声明与实际网络行为不符

Doc MismatchSensitive AccessPriv Escalation
ClawHub Sep 19, 2026
Open Report ↗
50 /100
Trust
Review

audit-adjustment-check-free

SKILL.md声明与实际网络行为不符

Doc MismatchSensitive AccessSupply Chain
ClawHub Sep 19, 2026
Open Report ↗
45 /100
Trust
Review

award-contract-consistency-check-free

SKILL.md 声明不联网但实际存在外部网络请求

Doc MismatchData ExfilPriv EscalationPrompt Injection
ClawHub Sep 19, 2026
Open Report ↗
55 /100
Trust
Review

asset-disposal-check-free

文档声称离线运行但实际有网络行为

Doc MismatchData ExfilPriv EscalationSensitive Access
ClawHub Sep 19, 2026
Open Report ↗
48 /100
Trust
Review

asset-impairment-check-free

匿名标识声明与实际不符

Doc MismatchData ExfilPriv Escalation
ClawHub Sep 19, 2026
Open Report ↗
55 /100
Trust
Review

clawpi-redpacket-monitor

Undeclared JWT token extraction from wallet config

Credential TheftRCEDoc MismatchSensitive Access
ClawHub Sep 19, 2026
Open Report ↗
35 /100
Trust
Review

agent-guard

External npm package with uninspectable code

Supply ChainDoc MismatchSensitive AccessCredential Theft
ClawHub Sep 19, 2026
Open Report ↗
35 /100
Trust
High Risk

companion-skill

Safety System Bypass Instructions

Prompt InjectionDoc Mismatch
ClawHub Sep 19, 2026
Open Report ↗
38 /100
Trust
High Risk

feishu-log

Hardcoded Feishu API Credentials in Source Code

Credential TheftDoc MismatchSensitive Access
ClawHub Sep 19, 2026
Open Report ↗
58 /100
Trust
Review

购物省钱宝

Undeclared outbound HTTP call on every query

Doc MismatchSupply ChainData Exfil
ClawHub Sep 18, 2026
Open Report ↗
50 /100
Trust
Review

social-postcjo

SKILL.md 与 SKILL.md.bak 声明不一致

Doc MismatchCredential TheftPersistenceSupply Chain
ClawHub Sep 18, 2026
Open Report ↗
← Previous
3 / 29
Next →