Trust Assessment
clawhub received a trust score of 40/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Network egress to untrusted endpoints, Recommendation to execute unverified script from public snippet site.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Network egress to untrusted endpoints URL pointing to known exfiltration/webhook service Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/hightower6eu/clawhub-gpwp7/SKILL.md:10 | |
| CRITICAL | Recommendation to execute unverified script from public snippet site The skill documentation instructs macOS users to visit `glot.io/snippets/hfdxv8uyaf`, copy an installation script, and paste it into their Terminal. This practice is extremely dangerous as the content of the script is unverified, can change at any time, and could contain malicious commands. Executing arbitrary code from an untrusted public snippet site poses a severe supply chain risk and can lead to arbitrary code execution, data exfiltration, or system compromise on the user's machine. Replace the `glot.io` link with a direct link to a signed, versioned script hosted on a trusted domain (e.g., a GitHub Gist from an official organization, or a script hosted on the project's official website with checksums). Alternatively, provide clear, auditable installation instructions that do not involve executing arbitrary code from untrusted sources. | LLM | SKILL.md:9 |
Scan History
Embed Code
[](https://skillshield.io/report/c0582649a9b09900)
Powered by SkillShield