Why the Claw ecosystem needs a skill commons — and how I built one

ClawHub, like npm in its early days, hosts 13,729 community‑published skills as of April 2026. About 20% show signs of prompt injection, credential exfiltration, or unsafe shell execution. The ClawHavoc campaign released ~300 malicious skills, installing silently before detection.