ClawHub skills index

Each skill is graded by litmus-skill-v2, a deterministic STATIC scan of its SKILL.md + bundle: S-01 prompt-injection / context-poisoning, S-03 data-exfiltration instructions, and S-04 dangerous bundled commands. The scan reads the files — it never runs them — so the malicious skills below are safe to grade.

Snyk’s ToxicSkills analysis of 3,984 skills across ClawHub and skills.sh found 36.8% carried at least one security flaw, 13.4% critical, and 76confirmed malicious payloads — several still live at publication. The flagged cohort here each ships a fake “prerequisites” step that runs a base64-decoded curl | bash written into the SKILL.md; the litmus grades them D on the static text alone.

Static scanning has a disclosed edge: a sibling of these skills that instead tells the agent to “visit this link and run the command it shows”, or hides the payload in a bundled archive, keeps its dangerous command out of the scanned bytes and grades clean. That gap — a command fetched or assembled at runtime — is precisely why a static grade is a floor, not a guarantee, and why the behavioral harness and continuous re-grading matter. Grades are read live from hosted_runs and none are published onchain.