Skill Security

Run these checks before installing ANY skill, package, or plugin. Always warn the user before proceeding.

Pre-Install Checklist

1. Source Verification

• Is it from clawhub.com (vetted) or a random npm package?
• Who's the author? Do they have other packages / reputation?
• Is there a GitHub repo? Check for recent commits, open issues, maintainer activity.

2. Popularity Check

• npm info <package> — check weekly downloads, last publish date, version history
• Low downloads (< 100/week) + recent publish = higher risk

3. Dependency Audit

• npm info <package> dependencies — how many deps does it pull in?
• More dependencies = larger attack surface
• Flag packages with 50+ transitive dependencies