Skill Manager
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx clawhubto perform management tasks such as installation, updates, and removals. These commands are executed in the user's shell environment. - [EXTERNAL_DOWNLOADS]: Skill packages are downloaded from the ClawHub registry at runtime. This is the primary intended function of the manager and is explicitly disclosed in the security notes.
- [REMOTE_CODE_EXECUTION]: By using
npx, the skill downloads and executes code from an external source. Security risks are mitigated by the requirement for explicit user consent before any installation or update occurs and the association of the registry with the vendor's infrastructure.
Audit Metadata