78,000 Skills Scanned: What We Found

VerifyClaw's crawler has pulled 79,239 skills out of ClawHub into our catalog so far. Of those, 75,357 have been run through our free 25-pattern grammar scan — the fast static pass every skill gets before anything paid ever touches it. This is what that corpus actually looks like.

Risk distribution

Put together, 5,015 skills — 6.65% of everything scanned — come back CRITICAL or HIGH on a purely mechanical, regex-driven pass. That's not a rounding error. It means roughly 1 in 15 skills in a public marketplace matches a known-dangerous pattern outright, before any semantic review of intent even happens.

The near-absence of MEDIUM (4 skills, effectively noise) reflects how the grammar engine is tuned: its 25 patterns target unambiguous, high-confidence signatures — hardcoded credential dumps, shell pipes to bash, raw eval calls — rather than soft heuristics that would pile up a lot of borderline MEDIUM verdicts. It scores what it's confident about and stays quiet otherwise, which is also exactly why a skill like SkillScan (see our companion post on that finding) can clear it with a 0 despite being actively malicious — pattern-matching has no lever for intent.

What's actually in the flagged 6.65%

Breaking down every matched pattern (reason_code) across the flagged skills, by volume:

1. secrets.env_dump — 1,802 matches. Skills that read and expose environment variables, the single most common red flag in the corpus by a wide margin.
2. injection.prompt_injection — 1,065 matches. Content engineered to override or redirect an LLM's own instructions.
3. code_execution.curl_pipe_shell — 929 matches. The classic curl | bash pattern — fetch a remote script and execute it unreviewed.
4. secrets.credential_file_access — 577 matches. Direct reads of credential files (SSH keys, cloud config, .env files) rather than environment variables.
5. exfiltration.post_sensitive — 573 matches. Outbound HTTP requests carrying data flagged as sensitive.
6. exfiltration.curl_external_ip — 369 matches. Network calls to raw external IPs rather than named, resolvable hosts — a common way to dodge domain-based allowlists.

Further down the list: code_execution.eval_exec (137), wget_pipe_shell (58), hex_decode (29), base64_decode_exec (19), rm_rf_root (12), soul_modification — skills that attempt to rewrite an agent's own persistent memory/instruction files (10), chmod_world_writable (10), and 9 skills carrying literal cryptomining payloads.

The shape of that list is worth sitting with: credential and secret exposure (env dumps + credential file access) alone accounts for over 2,300 of the flagged matches — more than double the next category. Whatever else a malicious or careless skill does, harvesting whatever secrets are lying around the environment it's given is consistently the first move.

What we're not claiming yet

We don't currently have reliable author-level attribution across the catalog — ClawHub's own metadata leaves the owner field empty for the skills we've crawled, so we can't yet say which publishers or accounts are responsible for a disproportionate share of flagged skills. That's a real gap, not a number we're going to round up to fill. Closing it (matching flagged skills back to consistent authors/orgs across re-uploads and forks) is next on our research list, and we'll publish what we find.

The full, searchable trust registry — every MCP server we've tested, with pass/fail detail per technique — is free to browse at verifyclaw.io.