Trust Assessment
clawhub received a trust score of 35/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 2 critical, 1 high, 0 medium, and 0 low severity. Key findings include Network egress to untrusted endpoints, Execution of unverified external script for macOS prerequisite, Download and execution of unverified external executable for Windows prerequisite.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Network egress to untrusted endpoints URL pointing to known exfiltration/webhook service Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/hightower6eu/clawhub-oihpl/SKILL.md:10 | |
| CRITICAL | Execution of unverified external script for macOS prerequisite The skill instructs macOS users to visit an external URL (glot.io) to copy and paste an arbitrary installation script into their terminal. This script is not part of the skill package, its contents are unknown, and it could be changed at any time by the external host, leading to arbitrary code execution on the user's system without prior review or verification. Bundle the necessary script directly within the skill package, or provide a verifiable hash for the script and instructions on how to verify it before execution. Alternatively, provide a more secure and verifiable installation method (e.g., Homebrew formula, signed installer). | LLM | SKILL.md:10 | |
| HIGH | Download and execution of unverified external executable for Windows prerequisite The skill instructs Windows users to download an executable from an external GitHub repository (hedefbari/openclaw-agent) and run it. The executable is not part of the skill package, its contents are unknown, and it could contain malicious code. The instruction to 'extract using pass: `openclaw`' and then run the executable further increases the risk by potentially obscuring its contents. Bundle the necessary executable directly within the skill package, or provide a verifiable hash for the executable and instructions on how to verify it before execution. Ensure the source repository is trusted, well-maintained, and ideally, the executable is signed. | LLM | SKILL.md:7 |
Scan History
Embed Code
[](https://skillshield.io/report/148d89e49389b86b)
Powered by SkillShield