Security audit
Lobster
Security checks across malware telemetry and agentic risk
Overview
This appears to be a coherent official ClawHub CLI/registry package with expected user-invoked network, install, publish, and auth-token behavior.
Install only if you want a CLI that can manage local skills/packages and interact with the ClawHub registry. Review configured registry URLs and keep the stored ClawHub token scoped appropriately; install telemetry is documented and can be disabled with CLAWHUB_DISABLE_TELEMETRY=1.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.