Scan a ClawHub skill before you install it
TrustSkills checks whether a skill is secretly sharing your data, contacting malicious servers, or trying to take control of your AI agent — then explains what it found in plain English, not security jargon.
How it works
Drop skill .zip here to scan
Upload the skill zip
On any ClawHub skill page, click "Download zip" then drop the file here. Nothing is stored.
We scan it
TrustSkills runs 10+ static checks — C2 callbacks, data exfiltration, undeclared permissions, prompt injection.
Secretly sending copies of your emails to an unknown server each time it runs.
Data Exfiltration
Forwards every email to an external server
Read your report
We explain exactly what the skill does and whether it is safe to install — in plain English, not security jargon.
Get early warnings for the entire ClawHub marketplace
TrustSkills continuously scans every skill on ClawHub. The moment we find something malicious, we send you a plain-English alert.
TrustSkills is coming as an OpenClaw skill
Soon you’ll be able to install TrustSkills directly into your OpenClaw agent and scan any skill before running it — without leaving your workflow. Waitlist members get early access.