Clawdex by Koi

**Quick judgement:** Clawdex is a focused, high-value safety layer for ClawHub that checks skills against Koi’s security verdict API. It’s well-suited as a default pre-installation gate and for periodic audits of existing skills. **Key strengths & benefits** - Provides a **simple, binary/ternary security verdict** (`benign`, `malicious`, `unknown`) for ClawHub skills. - **Clear operational guidance** on what to do for each verdict (install, block, or escalate for user review). - Enables **bulk scanning of already-installed skills**, catching legacy risks from before security checks were common. - Backed by a specialized **AI risk engine (Koi Wings)**, which can add meaningful protection beyond manual inspection for many users. **Risks & limitations** - **Single external dependency**: effectiveness and uptime depend on the availability and integrity of `https://clawdex.koi.security`. If it’s down or compromised, verdicts could be delayed, missing, or misleading. - **False negatives/positives are possible**: a `benign` verdict is not a formal proof of safety, and a `malicious` verdict depends on Clawdex’s detection quality and threat models. - The `unknown` result still **requires user or operator judgement**; it doesn’t remove the need for code review or policy decisions. - Primarily tailored to **ClawHub skill names**; it’s not a general-purpose scanner for arbitrary code or tools. **Recommended scenarios** - Use as a **default mandatory check** before installing any new ClawHub skill, especially on shared or production systems. - Integrate into **automated CI/security pipelines** that validate skill sets used by teams or internal assistants. - Run regular **post-install audits** to identify and remove newly flagged malicious skills. - Combine with **manual review and organizational policies** for skills returning `unknown` or when operating in high-security environments.