https://clawhub.ai/api/v1/skills/auto-skill-publisher/file?path=SKILL.md&version=1.0.0
github.com/clawhub.ai/auto-skill-publisher
Scanned Thu, 28 May 2026 16:40:40 GMT
Scan ID crawl-kwjvozoz973cya7e5zpx5exg · 2ms
A
SCORE 95 / 100
Verdict: Safe to install
2 medium findings.
This skill ships without a capability manifest plus 1 other issue listed below.
0 critical0 high2 medium10 rules passed
Why grade A?
score · 95 / 100The current grade reflects 2 minor findings below all thresholds.
0 CRIT0 HIGH2 MED0 LOW
Already at the top grade — no further rules to pass.
Findings · ordered by severity
medNo capability manifest declaredThe skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.rule: no-manifest▾
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule:
no-manifestmedSkill name mixes ASCII with lookalike non-ASCII charactersThe skill name `skill-slug # 必填：技能标识（小写+短横线）` contains characters that visually resemble ASCII letters but are from a different script: ： (U+FF1A), （ (U+FF08), ） (U+FF09). This is the standard typosquat pattern — installers think they're getting `stripe/checkout` and end up with a malicious lookalike.▾
Skill name mixes ASCII with lookalike non-ASCII characters
The skill name `skill-slug # 必填：技能标识（小写+短横线）` contains characters that visually resemble ASCII letters but are from a different script: ： (U+FF1A), （ (U+FF08), ） (U+FF09). This is the standard typosquat pattern — installers think they're getting `stripe/checkout` and end up with a malicious lookalike.
name: skill-slug # 必填：技能标识（小写+短横线）
skillox.io/r/crawl-kwjvozoz973cya7e5zpx5exg