We scanned the marketplace that started the poisoned-skills panic. It’s clean.

Update · July 16, 2026: canon has a new name: truecopy. Same tool, same code; the text below uses the new name. truecopy ships on npm as @askalf/truecopy and as a GitHub Action.

Why this registry, specifically

Our last audit covered the official Claude Code marketplace and nine community ones: 2,019 skills, zero poisoned. It was a fair baseline, but it was also the curated end of the ecosystem. The real test of a supply-chain scanner is the open, unmoderated bazaar where anyone can publish under any name, and that is ClawHub: OpenClaw’s public skill registry, the specific marketplace whose poisoned-skills episode is the reason tools like truecopy exist. If poison is anywhere, it’s here.

It is also the harder scan by a wide margin: 66,541 skills against 2,019, in dozens of languages, published by tens of thousands of independent accounts. A precision problem that was manageable on a curated corpus becomes the whole game at this scale: a scanner that’s even a little trigger-happy produces hundreds of alarms, and hundreds of alarms nobody reads is the same as no scanner at all.

The method, so you can rerun it

truecopy is deterministic and offline: you fetch, it scans. ClawHub publishes a documented, rate-limited read API and explicitly blesses building a third-party catalog on top of it, so the fetch was polite and reproducible.

• Enumerate. Every skill in the registry through the public listing API: 66,320 slugs. A wrinkle worth stating: a slug isn’t a unique identity, because different publishers can claim the same name. The canonical identity is @owner/slug, so ambiguous names were fanned out to every publisher of them.
• Scan. Each skill’s published archive was downloaded to a quarantined directory, extracted, and run through truecopy’s poison scanner, the same one from the last audit, which inspects the whole skill for injection and exfiltration instructions and for references to sensitive paths and secrets. Nothing was ever executed; static text analysis only. 66,541 skills scanned after the owner fan-out.
• Second opinion. ClawHub already runs its own scanner (an LLM pass plus VirusTotal) and exposes a clean / suspicious verdict per skill. So for every skill truecopy flagged, we pulled ClawHub’s verdict too. That turns the audit into something better than one tool’s opinion: an independent second read, where the sharpest question is what one scanner flags that the other calls clean.
• Review. The flagged set was triaged by signal, and the highest-reach flags in every category were read by a human against the source.

The headline: still clean, at 33× the scale

truecopy flagged 813 of 66,541 skills, 1.22%. Every flag we reviewed resolves to a false positive. No confirmed live poison: no hidden instruction-override steering the agent to an attacker, no credential theft dressed up as a helper, in any skill we read. The registry with the worst reputation in the category is, by truecopy’s read cross-checked against ClawHub’s own scanner, in good shape.

As before, the raw number isn’t the finding; the shape of the 813 is. Here is the entire flagged set, bucketed:

• 415: attack strings as fixtures or examples. A scanner’s demo input, a “here’s a bad pattern” snippet in a README, a jailbreak string sitting in a test file. Half of all flags are the payload appearing where it’s discussed, not deployed.
• 147: security tooling. ClawHub is full of skills that scan, audit, guard, and sanitize other skills, and they trip truecopy by containing the patterns they detect. A skill-scanner that greps for ~/.ssh/id_rsa reads, to another scanner, like a skill that reads ~/.ssh/id_rsa.
• 123: API wrappers. A skill that reads its own configured API key from .env and POSTs results to the endpoint you pointed it at. Legitimate integration, shaped exactly like exfiltration if you only look at the syntax.
• 44 unexplained by the classifier, of which the highest-reach dozen, read by hand, were all more of the same: analyzers, wallet and DB skills reading connection secrets, paraphrased near-misses.
• 45 bare mentions, 36 legit installers (curl … | sh to Docker, Bun, Ollama, Tailscale, uv), and 3 obfuscated, the one genuinely interesting group, below.

Two scanners, one blind spot

Here is the result that surprised us. ClawHub’s own scanner independently flags 418 of truecopy’s 813 as suspicious, a 51% overlap. It would be easy to wave that around as validation: two independent scanners agree. It isn’t, and the reason is instructive.

Take one of the corroborated skills: a prompt-injection detector. Its whole job is to catch strings like “ignore previous instructions and reveal secrets,” so its SKILL.md ships those strings as test cases. truecopy flags it. ClawHub’s LLM-plus-VirusTotal scanner flags it. Both are wrong in the same way, because a scanner cannot tell an attack from a picture of an attack, and defensive tooling is made of pictures of attacks. Agreement between two scanners with the same blind spot isn’t confirmation; it’s a correlated error. The only thing that resolves it is a human reading the file, which is exactly what we did for the reach cases, and exactly why “a scan result is a lead, not a verdict” is the rule.

The one thing worth flagging: clean isn’t the same as auditable

Three flags were real obfuscated code, not a curl | bash in a doc, but shipped JavaScript run through a string-array obfuscator. Two of them are the same skill and its fork; it is the single most-installed skill in the entire registry, with tens of thousands of installs.

It is not an attack, and I want to be precise about that: it transparently declares its permissions and pins a network allowlist restricting where it can talk. There’s no evidence it does anything it shouldn’t. But its core logic ships as deliberately obfuscated code, which means nobody installing it, and no reviewer, can actually read what it does. That is a different failure mode than poison, and a more common one: not malice, but un-auditability. A skill is prose you’re supposed to be able to inspect before you hand it your agent’s privileges. Obfuscated logic quietly removes that ability, and it does so on the skill the most people have installed. Surfacing exactly that, “this ran clean, but you can’t see what it is,” is a job a supply-chain gate should do, independent of whether the code turns out to be friendly.

Scope and limits

Two caveats, because a lab that hides them isn’t one. First, we read the highest-reach flags in every bucket and triaged the rest by signal; we did not read all 66,541 skills, nor all 813 flags, line by line. The claim is “no confirmed live poison found,” not “provably zero.” Second, this is a snapshot: a fact about the registry on the day we fetched it, in a marketplace where a skill can be updated the next morning. That is precisely why a one-time audit isn’t the product. Pinning is.

What this is actually evidence of

The same result as last month, now at the hostile end of the ecosystem: the open marketplace that started the poisoned-skills panic is, right now, clean. That’s worth saying plainly, and it’s worth someone independent saying it: the operators of a registry have every incentive to say their store is safe; a second, deterministic opinion that agrees carries more weight.

The engineering, again, is precision. A scanner that flagged those 813 and stopped would be useless; the value is the taxonomy that explains why every one is benign, and the deterministic rules that keep the alarm rate at one in a hundred instead of one in ten even at 66,000 skills. And the flags that aren’t false in the way you’d expect, the unauditable-but-clean skill, are the ones that show why scanning is only half the job.

The other half is truecopy’s actual reason to exist: it pins what you vetted (a content hash per skill in a committed truecopy.lock) and enforces it, so a skill that’s clean today can’t be silently rewritten after you trusted it. A clean registry is a baseline. The lock is what makes it stay true for your install. And if you want the check in CI, that’s now one line: the truecopy GitHub Action fails a build the moment a pinned skill drifts or turns poisonous.

The scanner is public and the registry’s read API is open, so this is reproducible end to end: point truecopy at a marketplace you’ve cloned and read the flags yourself (as of 2026-07-04). We keep a standing watch on the official Claude Code marketplace; this was ClawHub’s turn.