Was clawhub not doing any security on skills?
Presented as originally written:
"There's about 1 Million things people want me to do, I don't have a magical team that verifies user generated content. Can shut it down or people us their brain when finding skills."
UI is perfect for 'vote' manipulation. That is download your own plugin hundreds of times to get it to the top. Make it look popular.
No way to share to other that the plugin is risky.
Empowers users to do dangerous things they don't understand.
Users are apt to have things like API keys and important documents on computer.
Gold rush for attackers here.