clawhub
Fail
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration and instructions facilitate the installation of the
clawhubpackage from the public npm registry during the setup process. - [REMOTE_CODE_EXECUTION]: The primary purpose of the skill is to use
clawhub installandclawhub updateto fetch and execute agent skills fromhttps://clawhub.com. This allows for the execution of arbitrary remote code within the host environment from an unverified third-party registry. - [COMMAND_EXECUTION]: The skill utilizes the
clawhubCLI to perform operations such as installing packages globally (npm i -g) and managing local file systems. These operations often require elevated permissions and can execute scripts contained within the downloaded skills. - [DATA_EXFILTRATION]: The skill provides commands for
clawhub loginandclawhub publish, which involve transmitting credentials and local source code to a remote server.
Recommendations
- AI detected serious security threats
Audit Metadata