clawhub-hardened

SUSPICIOUS: The skill is broadly coherent with its stated purpose and uses an official npm-published CLI, but its main capability is transitive installation/updating of other skills, which is inherently higher risk for an agent. The most notable inconsistency is the registry domain mismatch (skill says clawhub.com, official docs reference clawhub.ai), plus support for arbitrary registry overrides and silent bulk updates. Not malicious on current evidence, but medium risk due to transitive trust and endpoint ambiguity.