Clawhub Skills Stats

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill coherently queries public ClawHub statistics using curl and local JSON parsing, with no credentials, persistence, or data mutation shown.

This appears safe for its stated purpose. Before installing, be aware that it can invoke curl and python3 to query clawhub.ai, and only provide ordinary ClawHub slugs or search terms.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI02: Tool Misuse and Exploitation

What this means

The skill may run a curl command to contact ClawHub and a python3 command to format the response.

Why it was flagged

The skill uses local shell tools and an external API call. This is directly aligned with the stated purpose of querying public ClawHub stats, but it is still a tool-use behavior users should notice.

Skill content

curl -s "https://clawhub.ai/api/skill?slug=SKILL_SLUG" | python3 -c "..."

Recommendation

Use normal ClawHub slugs or search terms, and avoid pasting untrusted shell metacharacters into the command examples.