v1.0.4

Skills.sh Search

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 4:51 AM.

Analysis

The skill appears to do what it says—search the skills.sh registry—but users should review any third-party skill before following the included install commands.

GuidanceSafe to use for searching the skills.sh registry. Treat install commands as suggestions, not approvals: review any discovered skill and confirm the intended install scope before adding it to Clawdbot.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

After finding a skill, install it using the `skills` CLI:

```bash
npx skills add vercel-labs/agent-skills
```

The skill’s documentation guides users from search results to installing third-party agent skills. This is disclosed and related to discovery, but installing external skills can change the agent environment and should be reviewed.

User impactIf a user follows the install guidance, they may add third-party skills that can affect future agent behavior.

RecommendationBefore installing a discovered skill, review its source, SKILL.md, permissions, and install scope; prefer project-scoped installation and ask for explicit user confirmation.