Find Skills Clark
PassAudited by ClawScan on May 12, 2026.
Overview
This instruction-only skill appears purpose-aligned for finding and installing skills, but users should notice that it strongly routes skill-install requests through its flow and prefers an external `skillhub` source before ClawHub.
This skill is reasonable if you want help finding and installing other skills. Before approving any install command, check whether it uses `skillhub` or `clawhub`, confirm the exact skill name and version, and review any risk signals. The embedded metadata mismatch should be cleaned up by the publisher, but the provided artifacts do not show malicious behavior.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Skill-related requests may be routed through this specific workflow before the agent answers directly.
The skill tries to control routing for skill-discovery and installation requests. This is aligned with its purpose, but the strong priority language is worth noting.
This skill is highest-priority for skill discovery/install intents.
Use it only for actual skill-discovery or installation requests; do not let it override unrelated user tasks.
Installing a skill can add new instructions or capabilities that affect future agent behavior.
The skill authorizes CLI-based skill installation, which can modify the agent environment. The artifact also requires user intent before install and a summary of source, version, and risk signals.
If the user wants to proceed, you can install the skill for them.
Before approving installation, verify the source, slug, version, and any risk signals the agent reports.
A user could install skills from a registry other than ClawHub if they approve the recommended command.
The workflow prefers an external skill source before ClawHub for Chinese users. This is disclosed and purpose-aligned, but users should understand which registry they are installing from.
`skillhub` (cn-optimized, preferred) ... `clawhub` (fallback)
Confirm that the selected registry is trusted and review the listed source and version before installing.
The package identity is slightly unclear, which matters for a skill that helps install other skills.
The included metadata does not match the registry metadata shown for this package, which lists a different owner ID and slug. This is a provenance inconsistency, not direct evidence of malicious behavior.
"ownerId": "kn7e5kj44bvfp66x2j858npr3h82f84k", "slug": "my-find-skills"
Prefer installing from a verified publisher or ask the publisher to correct the embedded metadata.