clawhub

SUSPICIOUS. The skill's stated purpose is a marketplace, but its practical footprint is mainly a transitive install instruction to fetch more skills from an only partially verified ecosystem. No direct credential theft appears, yet the unpinned install-by-name workflow, domain inconsistency, and downstream permission inheritance make this a meaningful supply-chain risk.