The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation section in SKILL.md instructs the user to run npx clawhub@latest install kasia. This command fetches and executes the clawhub package from the npm registry, which is not associated with a trusted vendor or well-known service.
[REMOTE_CODE_EXECUTION]: The use of npx (Node Package Execute) constitutes execution of remote code. Because the clawhub package is from an unverified source, this represents a risk where the setup process could execute arbitrary code on the user's machine.
[NO_CODE]: The provided skill files do not contain any of the scripts, functions, or logic necessary to perform the described tasks (sending/receiving messages on the Kaspa blockchain). The functional code resides entirely within the external package, making it impossible to perform a security audit on the actual behavior of the skill based on the provided content.

kasia