clawtributor

This skill is plausibly what it says — it helps agents file security reports to a GitHub repo — but there are several things to check before installing: - Verify provenance: SKILL.md, README, and skill.json reference slightly different hostnames/repos (prompt-security/ClawSec, clawsec.prompt.security, gclawsec.prompt.security). Confirm the official release URL and GitHub repository from a trusted source before downloading. - Confirm required tools: The SKILL.md installer uses jq, unzip, shasum (or shasum-compatible tool), stat, and other shell utilities but the declared required binaries only list curl, git, gh. Ensure jq and unzip exist or update the skill's declared requirements. - Review checksums.json before running: the installer attempts checksum verification and path-traversal checks — manually inspect the checksums.json and the release page to ensure they point to expected artifacts and hashes. - Understand automated reporting risks: the skill can programmatically create GitHub issues using your gh auth. Make sure your agent sanitizes all evidence and that you approve reports before they are submitted; consider disabling autonomous reporting until tested. - Test in a safe environment: install in a non-production account or VM first to observe behavior and confirm no sensitive data is posted. If you want higher assurance, ask the publisher for a canonical release URL, signed releases, or a reproducible release process, and insist the skill declares all required binaries (jq, unzip, shasum) in its metadata.