clawhub

SUSPICIOUS: the skill's purpose matches its behavior, but that purpose is to search for and install third-party agent skills. The main risk is transitive trust plus unpinned `npx @latest` execution from a different organization than the skill publisher. Data flow appears consistent with ClawHub's official npm/docs path, so this is not confirmed malware, but it is a high-risk capability for an agent environment.