360 Secure SkillHub
360 安全技能中心

Skill Scout

面向 ClawHub:在安装前查询目标技能的审核结论、标记原因、下载/安装/星标数、所有者、更新时间与许可证,输出报告并给出是否可安装的建议。依赖 Python 3 与 requests,按材料声明只进行只读 API 调用,不下载或安装任何内容。

gate76
gate76
热度 25.68
最近更新 2026-05-20 03:35:31
分类:安全依赖:代码执行 / 第三方 API应用场景:推荐 / 研究

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add cromabelt-skill-scout
Metadata
name
skill-scout
slug
cromabelt-skill-scout
title
Skill Scout — check skills before you install
description
Before you install any skill from ClawHub, run this first. It tells you if the skill is clean, flagged, or malicious — with download counts, installs, and owner info.
tags
["clawhub","openclaw","check","safety","flag","moderate","install","verify"]
version
1.0.0
author
Cromabelt Studios
contact
cromabeltstudio@gmail.com
platform
ClawHub
price
FREE
category
Security
security
This skill does not: - Download or install anything - Access credentials or keys - Modify system files - Send your data anywhere It only makes read-only API calls to clawhub.ai.

Skill Scout

Checks a ClawHub skill before you install it. Gives you the full picture in seconds.

Why you need this

Some skills on ClawHub are flagged as suspicious or hidden by moderators. OpenClaw downloads skills without checking moderation status first — so you could install a flagged skill and not know until it's too late.

Skill Scout tells you what you're about to install before you install it.

What it checks

For any ClawHub skill, it shows:

  • Moderation verdict (clean, suspicious, malicious)
  • Reason codes if flagged
  • Download count
  • Install count
  • Star count
  • Owner username and account age
  • When it was last updated
  • License type

Trigger phrases

  • "check this skill"
  • "is [skill name] safe to install"
  • "check skill on clawhub"
  • "scan this clawhub skill"
  • "clawhub safety check"
  • "skill scout [skill slug or URL]"

How to use

Give it a ClawHub skill slug or URL. Examples:

  • "check this skill: clawhub.ai/cromabelt-watchdog"
  • "is @someuser/some-skill safe to install"
  • "check skill: someuser/cool-tool"

Output format

SKILL SCOUT REPORT
==================
Slug: someuser/some-skill
Status: ✅ CLEAN / ⚠️ FLAGGED / 🚫 MALICIOUS
Reason: [what triggered the flag]

Stats:
  Downloads: 1,234
  Installs: 567
  Stars: 42

Owner: @someuser
License: MIT-0

Recommendation: [safe to install / check the flag reason first / do not install]

Why flagged skills are a problem

  • A flagged skill may still appear on ClawHub but with reduced visibility
  • Install count gets suppressed — fewer people find it
  • Users can install it before seeing the flag
  • Malicious skills can steal data or corrupt your agent

Skill Scout runs the check before any install happens.

Requirements

  • Python 3.x
  • requests library (for API calls)