Skills/ClawHub/site-launch-checklist

site-launch-checklist@1.2.0

VERIFIED· install only

Publisher claims: "Pre-launch checklist for shipping a new website. Orchestrates analytics setup (GA4, PostHog, Google Search Console, Ahrefs), legal compliance, security headers and audit, SEO and GEO with keyword research validated against Google Trends (robots.txt, sitemaps, llms.txt, AI policy, schema markup, hreflang), copywriting consistency via a TONE.md and a humanizer pass in the matching language, OpenGraph and social previews, full favicon set with manifest, quality gates (Lighthouse, Core Web Vitals, WCAG accessibility, mobile testing), and setup of a weekly SEO agent. Use this skill whenever the user mentions launching a site/app, deploying a domain to production, pre-launch audit, shipping a marketing/docs/SaaS site or lead magnet, or says "checklist for the site", "ready to ship", "before I go live", "audit before launch", "ready for prod", or asks for a site review." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher samber · publishing for 85 daysInstalls 1,160Last detonated 6d ago
$clawhub install site-launch-checklist
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:58 · npx invocation of non-well-known package — may execute untrusted code… explicit user confirmation.** Always ask via the question tool before running `npx skills add`, `claude mcp add`, or any equivalent install command — even when the skill…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:88 · npx invocation of non-well-known package — may execute untrusted code4. **Bulk install the agreed subset**: `npx skills add owner/repo --skill A B C`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsSKILL.md:256 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- [ ] All env vars documented and stored in a secrets manager (1Password, Doppler, Vault, or equivalent). Not in a `.env` file on someone's laptop.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:93 · npx invocation of non-well-known package — may execute untrusted code- Never run `npx skills add owner/repo` without `--skill` (that installs everything).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsreferences/weekly-seo-agent.md:234 · Collapsed <details> block carrying instructions<summary>Mistral Vibe — place config at <code>.vibe/agents/weekly-seo.toml</code> and prompt at <code>.vibe/prompts/weekly-seo.md</code></summary> [View config]Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageSKILL.md:24 · npx invocation of non-well-known package — may execute untrusted code- npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:85 · npx invocation of non-well-known package — may execute untrusted code1. **List available sub-skills**: `npx skills add owner/repo --list`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageevals/evals.json:27 · npx invocation of non-well-known package — may execute untrusted code"Runs `npx skills add <owner/repo> --list` to discover available sub-skills before proposing any install",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
MEDIUM
npx invocation of non-well-known packageevals/evals.json:30 · npx invocation of non-well-known package — may execute untrusted code"Never runs `npx skills add <owner/repo>` without the `--skill` flag (would install everything)",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
MEDIUM
npx invocation of non-well-known packageevals/evals.json:42 · npx invocation of non-well-known package — may execute untrusted code"Does NOT execute `npx skills add` without first asking user for confirmation",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06

Cost to the agent

Instructions loaded
≈7,818 tok
1 file · 13 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.