Security audit
Security checks across malware telemetry and agentic risk
This is a real security scanning helper, but its install script can bypass scans and uses unvalidated input in deletion commands, so it needs review before installation.
Install only if you are comfortable reviewing and running a shell script that stages, scans, deletes, moves, and installs skill directories. Avoid --skip-scan and --force unless you fully intend those effects, use only normal ClawHub slugs, and prefer verified package-manager installation for dependencies like uv.
## Requirements - `clawhub` CLI — `npm i -g clawhub` - `uv` — `curl -LsSf https://astral.sh/uv/install.sh | sh` ## Why This Matters
stage_skill() {
print_info "Fetching $SKILL_SLUG to staging area..."
rm -rf "$STAGING_DIR/skills/$SKILL_SLUG"
mkdir -p "$STAGING_DIR"
# Install to staging directory (clawhub creates skills/<slug> under workdir)if [[ -d "$SKILLS_DIR/$SKILL_SLUG" ]]; then
if [[ -n "$FORCE_ARG" ]]; then
rm -rf "$SKILLS_DIR/$SKILL_SLUG"
else
print_error "Skill already exists at $SKILLS_DIR/$SKILL_SLUG (use --force to overwrite)"
exit 1# Cleanup staging
cleanup() {
rm -rf "$STAGING_DIR/skills/$SKILL_SLUG" 2>/dev/null || true
}
# Main flow64/64 vendors flagged this skill as clean.
Detected: suspicious.prompt_injection_instructions