705 skills every scanner cleared still instruct a CIS-banned action, and a third of executed commands had undocumented consequences.

This study scanned 66,192 public ClawHub skill versions and found 705 from 135 publishers that every scanner and the registry judge passed, yet which instruct actions prohibited by CIS Control 2.7 and NIST SP 800-53 CM-11. Hand-auditing 100 puts detector precision at 92%, with no sign of malicious intent, and one publisher contributes 506 of the 705. Separately, of 144 commands a live agent executed while following real skill documentation, 34.7% carried a consequence class the document never mentioned. Registry scanning answers "is this malicious," which is a different question from "is this permitted here, by this operator, right now." Their deterministic resolver with no model in the decision path stopped all 23 attempts across 53 already-cleared skills.