⚠
High Risk:This skill has significant security concerns. Review the findings below before installing.

secure-install

⚠Caution·Scanned 2/18/2026

This skill queries https://clawdex.koi.security/api/skill/${safeName} (and references https://www.koi.ai/) to classify skills, then runs the clawhub CLI to install approved skills. It performs external network requests and executes clawhub install ${skillName} using an unsanitized skillName, enabling potential shell-command injection.

from clawhub.ai·v3e3ac8d·4.6 KB·0 installs
Scanned from 1.0.1 at 3e3ac8d · Transparency log ↗
$ vett add clawhub.ai/smintlife/secure-installReview security findings before installing

# Secure Skill Installer

This skill provides a secure workflow for installing capabilities. It checks the **ClawDex API by https://www.koi.ai/\*\* and enforces strict installation rules based on the security verdict.

## Usage

User: secure-install <skill-name>

## Workflow (Strict)

When the user requests to install a skill:

1. **SCAN**: Call scanSkillApi with the target skill name to query **https://www.koi.ai/\*\*.

2. **EVALUATE VERDICT**: Check the verdict field in the JSON response.

  * **If verdict is "malicious"**:

  * 🔴 **BLOCK ACTION**.

  * Report: "🚨 **Security Alert**: The **ClawDex API by https://www.koi.ai/\*\* flagged this skill as **Malicious**. Installation prevented."

  * **STOP**. Do not proceed.

  * **If verdict is "unknown"**:

  * ⚠️ **WARN USER**.

  * Report: "⚠️ **Unknown Safety Status**: This skill has not been verified by the ClawDex API (https://www.koi.ai/)."

  * **ASK**: "This carries a risk. Do you explicitly approve the installation of <skill-name>?"

  * **WAIT** for clear "Yes".

  * **If verdict is "benign"**:

  * ✅ **CONFIRM SAFETY**.

  * Report: "✅ **Verified Safe**: ClawDex API by https://www.koi.ai/ reports this skill is benign."

  * **ASK**: "Do you want to proceed with installing <skill-name>?"

  * **WAIT** for "Yes".

3. **INSTALL**:

  * **Only** call executeClawhubInstall if the user provided explicit approval in the previous step.

## Example (Malicious Block)

**User**: secure-install bad-actor

**Agent**: (Calls scanSkillApi)

**ClawDex API (https://www.koi.ai/) Report**

🔴 **Verdict: Malicious**

**Security Alert**: This skill is flagged as malicious. Installation prevented.

## Example (Safe Install)

**User**: secure-install weather-pro

**Agent**: (Calls scanSkillApi)

**ClawDex API (https://www.koi.ai/) Report**

✅ **Verdict: Benign**

Verified safe. Do you want to proceed with installing weather-pro?

**User**: Yes

**Agent**: (Calls executeClawhubInstall)

Installed weather-pro.