Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is documentation that teaches an agent to use the ClawdHub command-line tool. It instructs the agent to install the clawdhub npm package globally, then use commands to sign in, search, install, update, list, and publish skills from clawdhub.com. The package contains no runtime code of its own, hidden data, or obfuscation. The main concerns are that it can download and install remote third-party skills, apply forced non-interactive updates, publish local folders, and point the client at a different registry. Those actions match the stated purpose but could be risky in an agent that holds credentials or can spend money.
Instructions try to steer the agent beyond the declared purpose. This package does not embed hidden instructions, but it is designed to fetch and install third-party skills (SKILL.md line 27) and supports forced non-interactive updates to all installed skills (SKILL.md line 37). Downstream skill content could therefore contain instructions that reach the agent.
| Declared purpose | Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. |
| Observed behavior | The package provides shell examples for npm install -g clawdhub, clawdhub login, whoami, search, install, update, list, and publish. The SKILL.md metadata also requests installation of the npm package clawdhub. No bundled executable or script is present. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The documented CLI commands search, install, update, and publish against clawdhub.com; the registry can be overridden with CLAWDHUB_REGISTRY or --registry (SKILL.md lines 22, 27-37, 47, 51). |
| shell | needed | The skill is a set of bash code blocks containing npm and clawdhub commands (SKILL.md lines 10-47). |
| filesystem_write | needed | Install and update commands write skills under ./skills by default (SKILL.md lines 27-37, 52). |
| filesystem_read | needed | The publish command reads a local skill folder and uploads it to the registry (SKILL.md line 47). |
| credentials | needed | The clawdhub login command creates or uses ClawdHub authentication for publishing (SKILL.md lines 14-17). |
| install_packages | needed | The package instructs npm i -g clawdhub and the metadata requests installation of the npm package clawdhub (SKILL.md lines 4, 11). |
| severity | finding |
|---|---|
| medium | Requests installation of the clawdhub npm package The skill metadata requests installation of the package clawdhub as a global tool. This fetches third-party code from npm and makes the clawdhub command available to the agent. SKILL.md:4 "install":[{"id":"node","kind":"node","package":"clawdhub","bins":["clawdhub"],"label":"Install ClawdHub CLI (npm)"}] |
| medium | Global npm install command The documentation tells the agent to run this command, which downloads and executes code from the npm registry and installs it globally. SKILL.md:11 npm i -g clawdhub |
| medium | Authentication for publishing The login command indicates the CLI will manage ClawdHub credentials, and the agent may be asked to supply or store them. SKILL.md:16 clawdhub login |
| medium | Installs skills from remote registry This fetches an arbitrary skill from clawdhub.com and writes it into the local skills directory. The content of installed skills is third-party and can contain further instructions. SKILL.md:27 clawdhub install my-skill |
| high | Non-interactive forced update of all skills This updates every installed skill without input and with force, so previously reviewed content can be replaced without confirmation. The skill card itself lists this risk at lines 24-26. SKILL.md:37 clawdhub update --all --no-input --force |
| medium | Publishes local skill folder to registry This command uploads the contents of ./my-skill, including any files there. If secrets or private files are present in that directory, they would be published. The skill card warns about this at lines 28-30. SKILL.md:47 clawdhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs" |
| medium | Registry can be overridden The CLI default registry is clawdhub.com, but the documented environment variable or flag can point the tool at another server. An untrusted registry could serve malicious skills or collect data. The skill card warns about this at lines 32-34. SKILL.md:51 - Default registry: https://clawdhub.com (override with CLAWDHUB_REGISTRY or --registry) |
| info | Publisher profile link The package documentation links to the publisher's profile on clawhub.ai. No code in the package automatically contacts this URL. skill-card.md:9 https://clawhub.ai/user/steipete |
| info | Known risk acknowledged by publisher The skill card acknowledges that broad install and forced update commands can change installed skills unexpectedly and recommends review before use. skill-card.md:24 Risk: Broad install and forced update commands can change installed agent skills unexpectedly. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawdhub.com | not in the service index | SKILL.md:51 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | bash, node, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 53 | dc6e717f4ac6d340… |
_meta.json | 6 | eaec24e29fe34c2c… |
skill-card.md | 57 | 5122a8ca0e39d61d… |
For agents
JSON: https://agenteconomy.report/k/clawdhub.audit.json · badge: https://agenteconomy.report/k/clawdhub.audited.svg ·
skill rating: /k/clawdhub · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).