Updated 3mo ago
by snyk-labs
toxicskills-goof
ToxicSkills - malicious agent skills in openclaw / clawhub / agent supply chain
19 GitHub stars (19)
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | 0 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | 0 |
| Oct 7 | −1 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | 0 |
- 7 skills (7 skills found in its SKILL.md files)
- 13 forks (13 forks)
- 3mo ago last update (Last updated 3mo ago)
Install
Skills CLI
npx skills add snyk-labs/toxicskills-goof
Asks which skills and agents to install. Just one: npx skills add snyk-labs/toxicskills-goof --skill 'Git tips and tricks for local git development' — add -g for every project.
Claude Code
git clone https://github.com/snyk-labs/toxicskills-goofcp -r "toxicskills-goof/demos/skill-with-commands" ~/.claude/skills/
Copies the Git tips and tricks for local git development skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add snyk-labs/toxicskills-goof
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
Git tips and tricks for local git development
Run diff, commit, push and other git related commands
demos/skill-with-commands/SKILL.md on GitHub (opens in a new tab) -
clawhub
Use ClawHub CLI to search, install, update, and publish agent skills from clawhub.ai with advanced caching and compression. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with optimized performance.
.agents/skills/clawhub/skill.md on GitHub (opens in a new tab) -
google
Use when you need to interact with Google services from Clawdbot, including Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
.agents/skills/google/SKILL.md on GitHub (opens in a new tab) -
vercel
Use when you need to deploy projects to the Vercel hosting platform in the cloud, such as Next.js applications, static sites, and serverless functions.
.agents/skills/vercel/SKILL.md on GitHub (opens in a new tab) -
skill-defender
Scans installed OpenClaw skills for malicious patterns including prompt injection, credential theft, data exfiltration, obfuscated payloads, and backdoors. Use when installing new skills, after skill updates, or for periodic security scans. Runs deterministic pattern matching — fast, offline, no API cost.
.gemini/skills/skill-defender-1.0.0/SKILL.md on GitHub (opens in a new tab) -
Use Snyk to do security scans and audit project security
A handful of commands available for code security, dependency security and other security audits using Snyk
.gemini/skills/snyk-skill/SKILL.md on GitHub (opens in a new tab) -
testing-guidelines
Use this skill when you are writing tests, refactoring test, or asked to run tests. This skill provides you with guidelines for testing the project.
.gemini/skills/testing-guidelines/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.