GoPlus Report: 21% of Top100 High-Frequency Skills in ClawHub Ecosystem Have Explicit High-Risk Operations

GoPlus recently released a report stating that after scanning the top 100 high-frequency downloaded Skills in the ClawHub ecosystem, it found 21% (21 skills) have explicit high-risk operations (such as network penetration, sensitive API calls), and 17% (17) have certain risks.

GoPlus suggests that high-risk Skills need to add the Human-in-the-Loop (HITL) manual confirmation mechanism; risky Skills should be executed cautiously, and users with high security needs should also add manual confirmation.

Security practitioners point out that this exposes the neglect of security in the AI agent ecosystem, with high supply chain attack risks. Attackers use encoding to evade detection and steal sensitive information. Short-term mitigation can be done via HITL, while long-term requires underlying security integration in the ecosystem.