3 checks before installing a skill
Someone put 314 malicious skills on ClawHub: check the source, scan the code, question the permissions, in under five minutes.
308 saves on X, as of Posted
3 checks I run before installing any skill now
1. source: who's the author, do they have other legit projects
2. code scan: search for curl, wget, exec, external URLs
3. permissions: does it need file system access? shell? why?Next Run them on any skill before you install it in your agent.
Someone published 314 skills on ClawHub. Every single one was malicious. Once installed, they read your MEMORY.md, SOUL.md, everything your agent remembers, leaked.
I checked my own 5 agents. Clean. But honestly, cold sweat.
Takes less than five minutes. Installing skills without these three checks is like signing a contract without reading it.
Share this tip
