clawhub

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md sets a default registry "https://clawhub.com" which the clawhub CLI uses at runtime (e.g., via "clawhub install" / "clawhub update") to fetch and install skills — i.e., remote code that can be executed or control agent behavior.