ClawHub ↗
ClawHub is an unverified plugin from ClawHub. Anomity scores its risk at 80 out of 100 (critical).
Analysis summary
ClawHub is an unverified plugin from ClawHub. Anomity scores its risk at 80 out of 100 (critical).
ClawHub is a public registry for Claude Code plugins — a central index where authors publish and users discover plugins, described by its community as npm for agent skills.
It is catalogued as ecosystem infrastructure rather than as a plugin you install for a task. Its declared capabilities are outbound network access for the registry API plus the filesystem writes involved in installing what it distributes. Registries concentrate risk by design: they are the single point where a compromise reaches everyone downstream, which is an argument for pinning versions and for preferring plugins whose source you can read over ones you discover by search rank.
Why this entry scored 80 out of 100
This profile starts at the catalog's neutral base of 50. Because the entry is unverified publisher, trust adjusts the score by +20. Declared high-risk capabilities add +10 (capped at +30). It matches no dangerous capability combinations. The clamped result is 80, placing it in the critical band.
Findings
-
Unknown publisher Critical
-
1 high-risk capability: filesystem:write High
Capabilities
Every capability the entry declares, with the security implication of each.
-
filesystem:writeFilesystem writeCan create, edit, or delete files on the host system. High-impact capability — anything from helpful edits to planting persistence. -
network:outboundOutbound networkCan make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access.