Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
Review
agentkind
Dangerous curl|sh pattern in documentation
ClawHub Sep 18, 2026
Open Report ↗
Review
fork-latte-skill
Hardcoded API key embedded in skill files
ClawHub Sep 18, 2026
Open Report ↗
High Risk
mcp-server-builder
X402_API_KEY harvested from environment
ClawHub Sep 18, 2026
Open Report ↗
Review
smyx-fish-surface-symptom-detection-analysis
Undeclared local SQLite database with credential storage
ClawHub Sep 15, 2026
Open Report ↗
Review
ClawCode Lens
Local-only claim contradicts documented external upload path
ClawHub Sep 15, 2026
Open Report ↗
Review
xhs-note-analyst (账号诊断)
Obfuscated wc3-code.mjs with undeclared data exfiltration path
ClawHub Sep 14, 2026
Open Report ↗
High Risk
gaode-taxi
未声明的第三方代理数据中转
ClawHub Sep 14, 2026
Open Report ↗
Review
xinjianxue-skill-long_distance-cn
数据处理声明仅依赖文档，无代码验证
ClawHub Sep 14, 2026
Open Report ↗
Review
smyx-driver-flushing-sweat-detection-analysis
Undeclared subprocess execution capability
ClawHub Sep 14, 2026
Open Report ↗
Review
smyx-respiratory-rate-abnormal-detect-analysis
Undisclosed local SQLite token storage
ClawHub Sep 14, 2026
Open Report ↗
High Risk
nemesis-c2-bridge
Offensive C2 with /kill Endpoint
ClawHub Sep 14, 2026
Open Report ↗
Review
smyx-workplace-stress-heatmap-analysis
Undeclared local SQLite database with user identity
ClawHub Sep 13, 2026
Open Report ↗
Review
smyx-family-conflict-aftercare-suggest-analysis
Silent user identity auto-registration
ClawHub Sep 13, 2026
Open Report ↗
High Risk
northcap-donor-badge
Compiled bytecode points to undisclosed IP
ClawHub Sep 13, 2026
Open Report ↗
Review
delvorn-register
Undeclared promotional content injection script
ClawHub Sep 13, 2026
Open Report ↗
Review
tokst-memory
curl|bash管道执行远程脚本
ClawHub Sep 13, 2026
Open Report ↗