Is erview/clawhub-skill-creator safe?
Yes. erview/clawhub-skill-creator is safe to install. Oathe's behavioral security audit gave the clawhub-skill-creator skill by erview a trust score of 92/100 with 3 findings, none critical or high.
https://clawhub.ai/erview/clawhub-skill-creator
Is erview/clawhub-skill-creator safe to install?
This skill provides comprehensive documentation for creating and managing skills in the clawhub registry. The skill appears legitimate with no evidence of malicious intent, data exfiltration, or prompt injection attempts. The main security considerations are the presence of shell scripts and dependencies on external registry systems.
What security issues were found in erview/clawhub-skill-creator?
Category Scores
Findings (3)
MEDIUM Executable shell scripts present -15 ▶
The skill contains two shell scripts (init-skill.sh and package-skill.sh) that create directories, files, and packages. While they appear benign and serve legitimate purposes for skill creation workflow, executable scripts always present some risk.
LOW Large token footprint -5 ▶
The skill contains extensive documentation (300+ lines) that consumes significant context window space. While not malicious, this could impact agent performance in token-constrained scenarios.
LOW External system dependencies -10 ▶
The skill references and encourages interaction with external clawhub registry system for publishing skills. This creates dependency on external infrastructure that could potentially be compromised.
Should I install erview/clawhub-skill-creator?
Oathe's verdict for erview/clawhub-skill-creator is SAFE with a trust score of 92/100. Recommendation: Install.