clawdhub

SUSPICIOUS: the stated purpose matches a skill-registry CLI, but the verified official project uses different package/domain identifiers than this skill documents. Because the CLI handles auth and installs additional skills, that provenance mismatch and transitive trust chain raise medium-high supply-chain risk even without direct evidence of malware.