clawhub

SUSPICIOUS: the skill is broadly consistent with a skill-registry CLI, and the npm install path appears official, but its primary purpose is transitive installation of additional skills and it contains a domain inconsistency (`clawhub.com` vs documented `clawhub.ai`). This is not confirmed malware, but it carries medium risk because it expands trust to externally fetched skills and a globally installed CLI.