Is clawhud safe?
https://clawhub.ai/zaycv/clawhud
This skill is non-functional — it failed to install with a 'Skill not found' error and contains an empty SKILL.md. The only file present is a lock.json referencing a different skill name ('academic-research-hub') than the slug ('clawhud'). No malicious content, code execution, or data exfiltration was detected. All network activity during the clone attempt is attributable to standard system operations and the clawhub CLI tool.
Category Scores
Findings (5)
LOW Skill failed to install — not found -5 ▶
The skill resolution failed with 'Skill not found' error. The clawhub registry could not resolve the 'clawhud' skill. This means no actual skill content was deployed.
LOW Lock file references different skill name than slug -25 ▶
The lock.json file references a skill called 'academic-research-hub' but the audit target slug is 'clawhud'. This naming mismatch could indicate a renamed skill, a template artifact, or potentially a bait-and-switch pattern where the lock file points to a different skill than expected.
INFO Empty SKILL.md — no prompt content to analyze -15 ▶
The SKILL.md file is completely empty. There are no instructions, no prompt injection attempts, and no skill functionality defined. This is a hollow skill.
INFO Standard system network activity during clone -10 ▶
All observed network connections are attributable to standard Ubuntu system services (apt, NTP, mDNS, CUPS) and the clawhub CLI tool's skill resolution process. No unexpected or suspicious external connections were detected.
INFO Jiti cache files created during resolution -10 ▶
Multiple .cjs files were created in /tmp/jiti/ during the skill resolution process. These are JIT-compiled TypeScript modules from the clawhub CLI toolchain, not from the skill itself. File names suggest standard config/plugin/auth modules.