ClawHub's New Abuse Scoring Treats Agent Skills Like a Marketplace, Not a Folder of Markdown

Agent skill registries cannot stay cute forever. The moment a registry influences what agents install, trust, invoke, or recommend, it stops being a folder of Markdown and becomes supply-chain infrastructure. That means popularity metrics become attack surface, publisher accounts become assets, and “community discovery” becomes a moderation problem whether the maintainers wanted one or not.

ClawHub PR #2536, created and merged on June 6, is a good sign that the OpenClaw ecosystem understands the transition. The PR adds cohort-relative temporal abuse scoring for publisher moderation. Instead of relying on fixed download thresholds, ClawHub now benchmarks the scanned skill cohort and flags packages in the top P95 or P99 for 30-day download volume or 7-day spike multiplier, especially when install conversion remains near zero. That combination is not proof of abuse. It is exactly the kind of mismatch a registry should put in front of a reviewer.

The diff is substantial: 10 files, 769 additions, 59 deletions, plus tests across scoring, publisher abuse, dev seed behavior, route handling, TypeScript, and formatting. The management drawer now renders suspicious 30-day volume, spike multiplier, cohort band, and peer threshold inside Publisher activity. Publisher escalation uses the new evidence: one P99 temporal hit can become a potential ban candidate; one P95 hit becomes review; multiple high temporal hits escalate further.

Raw popularity is the easiest metric to game

Fixed thresholds are comforting because they are easy to explain. They are also easy to reverse-engineer. If a package gets flagged at 10,000 downloads, an attacker learns to stay under 10,000 or distribute activity across packages. Cohort-relative scoring is better because it asks a more contextual question: does this package look strange compared with its peers right now?

The signal ClawHub chose is particularly useful because it looks for disagreement between metrics. High download velocity with near-zero installs deserves attention. A legitimate package can absolutely have a burst of interest before conversion catches up, especially after a blog post or launch. But manipulated packages often optimize the visible metric while failing to produce downstream behavior that real users create. The mismatch does not convict the package. It tells a moderator where to look.

That distinction is important. Abuse scoring should not become an automated guillotine. The PR's framing as reviewer evidence is healthier than pretending a percentile band can determine intent. The UI exposes the cohort band and peer threshold, which gives moderators context instead of a magic number. Good registry governance is not “the algorithm banned you.” It is evidence, review, escalation paths, and enough transparency for maintainers to defend decisions.

The timing is not accidental. ClawHub is no longer just a place to render SKILL.md. Its README describes a public skill registry for OpenClaw with publishing, versioning, search, vector search, stars, comments, admin/mod curation, local install pinning, and package browsing with family, trust, and capability metadata. Same-day adjacent PRs worked on auth-locked deleted accounts, account recreation after deletion, and user package digest sync. That is marketplace behavior, not static-site behavior.

OpenClaw's risk profile changes as ClawHub becomes more central. A prompt-only skill can still shape agent behavior. A native plugin or package can do much more. Once users browse, install, pin, and trust packages from a registry, that registry becomes part of the agent runtime's security boundary. Local approval prompts help, but they cannot fully compensate for a noisy or manipulated supply chain. If the ecosystem's trust metadata is bad, operators inherit that risk at install time.

For practitioners, the immediate guidance is simple and slightly annoying: stop installing agent skills like dotfiles from a random gist. Prefer pinned versions. Inspect publisher history. Check capability metadata. Treat sudden popularity as a question, not proof. If a package has download spikes but little install evidence or weak publisher history, slow down. Agent skills are executable influence over your runtime, even when they look like documentation.

For registry operators, ClawHub's approach is the shape to copy: cohort-relative signals, persisted evidence, reviewer-facing UI, and escalation that distinguishes review from ban. Add identity hardening, deleted-account handling, provenance metadata, and install conversion analysis. The goal is not to eliminate all malicious packages with one clever score. The goal is to make manipulation more expensive and reviewer attention more targeted.

There is also a cultural point here. Open-source ecosystems often resist marketplace language because it sounds commercial or heavy. But incentives do not care what you call the website. If stars, downloads, comments, featured lists, or agent recommendations influence adoption, people will try to game them. Registry governance is not bureaucracy bolted onto community. It is how community survives contact with incentives.

ClawHub's temporal abuse scoring is not the end of the trust story. It is the beginning of treating the skill ecosystem like something attackers might rationally care about. That is the right posture. The moment agent skills can steer tools, credentials, context, or workflows, moderation stops being optional plumbing and becomes part of the runtime trust model.

Sources: ClawHub PR #2536, ClawHub repository, ClawHub PR #2539, ClawHub PR #2541