Prototype, not launched. Facts are cited; anything not human-checked is marked unverified. Not affiliated with or endorsed by ClawHub, OpenClaw, or any vendor listed.

Methodology

How Agent Review Lab reviews skills, prices and recipes.

Skills

1. Public ClawHub read API only, cached, respecting rate limits; link to canonical listing.
2. Deterministic pattern scan of SKILL.md text. Nothing executed or installed. Matches are phrase hits only and can be harmless (documentation, checklists, or wording that denies needing secrets).
3. Owner-approved verdict labels (OK / Caution / Needs review) summarize the automated scan; we have not audited skill code or run it. Reviewed date appears on each card.

Verdict scale:

• OK — no concerning patterns, or matches explained as harmless wording.
• Caution — something worth noticing before install (e.g. expected OAuth setup, or flags from checklist text).
• Needs review — skill text describes writing agent memory/persona files and/or background hooks/heartbeat; read before trusting.

Patterns (neutral labels; a hit is not an accusation):

• Mentions pipe-to-shell (curl/wget | sh): (curl|wget)[^\n|]*\|\s*(ba|z)?sh
• Mentions base64 decoding: base64\s+(-d|--decode)|b64decode|atob\(
• Mentions admin (sudo) commands: \bsudo\b
• Mentions recursive delete (rm -rf): rm\s+-rf
• Mentions package install commands: \b(npm|pnpm|yarn)\s+(i|install|add)\b|\bpip3?\s+install\b|\bbrew\s+install\b|\bapt(-get)?\s+install\b|\bgo\s+install\b|\bcargo\s+install\b
• Mentions credentials or API keys: api[_ -]?key|\btoken\b|secret|password|credential|\.env\b|ssh
• Mentions paste-site or raw script hosts: glot\.io|pastebin|gist\.githubusercontent|raw\.githubusercontent
• Contains instruction-style phrasing: ignore (all |any )?(previous|prior) instructions|do not tell the user|without asking
• Mentions agent memory/persona files: SOUL\.md|AGENTS\.md|MEMORY\.md|TOOLS\.md
• Mentions hooks, cron, or background tasks: \bhooks?\s+enable|\bcron\b|crontab|heartbeat

Costs

Official vendor pages only; date-stamped; cost-per-task from fixed test tasks, published with inputs (planned).

Recipes

Sourced from public posts with credit; marked Untested until we reproduce them; then Tested with date, agent version and cost.

Independence

Sponsors and paid listings never change verdicts or rankings; sponsored items are labelled.