claw-werewolf
Audited by Socket on Feb 18, 2026
1 alert found:
Security[Skill Scanner] Download or install from free hosting/deployment platform detected No malicious behavior was found in the provided SKILL.md fragment. The file contains only metadata, description, and public URLs; it does not include executable code, secrets, or instructions that would indicate credential harvesting or code execution. However, because the actual implementation that runs during install or at runtime is not present, a full security assessment is incomplete: review of the skill's code, installation scripts, and network endpoints is required to be certain. Based on the doc alone, this appears benign but requires code-level review for final judgment. LLM verification: Based on the provided SKILL.md alone, the skill's stated purpose (auto-registering bots and providing a read-only viewer) aligns with the capabilities it advertises. There is no embedded code to inspect for malicious operations. The main risk is supply-chain/trust: the skill relies on a custom registry (clawhub.ai) and a Vercel-hosted frontend, so users should verify those services and any runtime permission requests before installing. Overall the content appears benign, with moderate caution ad