Ultimate Skills Finder

PassAudited by ClawScan on May 3, 2026.

Overview

This skill appears to be a purpose-aligned skill search tool, but users should notice that it can suggest installing third-party skills from multiple external sources.

This appears safe to use as a search aid, but treat any suggested installation as a separate trust decision. Before installing a recommended skill, confirm the source, run the optional scan when available, and approve only the exact install command for the skill you want.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the user approves installation, the agent may add new third-party skills that can later affect the user's agent behavior.

Why it was flagged

The skill may direct the agent to run commands that install third-party skills into the user's local agent environment. The instruction requires asking the user first, so this is disclosed and user-directed, but it is still a high-impact action users should review.

Skill content

Then ask which one(s) to install and do it:

```bash
# ClawHub
clawhub install <slug>

# skills.sh
npx skills add <owner/repo>

# Manual (from GitHub)
git clone <repo> ~/.openclaw/workspace/skills/<name>
```

Recommendation

Only install skills the user explicitly selects, prefer trusted sources, and review or scan the target skill before installation.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Search results may point to skills whose quality or safety varies by source.

Why it was flagged

The finder intentionally searches large third-party catalogs, including a source described as raw/uncrated. This is aligned with the skill's purpose, but results may include unreviewed or lower-provenance skills.

Skill content

SkillsMP (skillsmp.com) ... Scale: 1,000,000+ skills indexed ... Note: Raw/uncrated — minimum 2 stars filter

Recommendation

Treat search results as leads rather than endorsements; use the optional security scan and verify the publisher, source repository, and install command before installing.