clawhub
ClawHub CLI \u2014 install, update, search, and publish skills plus OpenClaw packages.
This report shows the evidence for clawhub@0.25.1. 0 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package is a CLI with no install-time hook, and the flagged process call only reads the current Git commit. The inspected GitHub and account actions serve explicit CLI operations, with starring gated by confirmation or `--yes`; no malicious behavior was found.
Decision evidence
public snapshot- The package exposes `clawdhub` and `clawhub` as CLI binaries.
- The binary loads the CLI entry point; the manifest declares no install, preinstall, or postinstall hook.
- The build-info process call runs `git rev-parse HEAD` in the current working directory to read a commit ID.
- GitHub source fetching reads `GITHUB_TOKEN` within the GitHub import flow; the source uses it to retrieve a user-selected repository.
- The star command asks for confirmation unless `--yes` is supplied, then requires the user's authentication token.
Source & flagged code
5 flaggedPackage source references child process execution.
dist/cli/buildInfo.jsView on unpkg · L1A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli/commands/github.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to clawhub@0.25.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of clawhub@0.25.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.