clawhub

SUSPICIOUS: the skill is purpose-aligned and uses plausible official ClawHub/OpenClaw domains, but its main function is transitive skill installation through manual download-and-extract of unverified archives into the live skills directory. The lack of integrity verification and the inherited trust of installed skills make this medium-to-high risk despite low evidence of explicit malware or credential theft.