Crypto-relevant agent skills from ClawHub and skills.sh, each with a static DISCLOSURE: hosts it contacts, whether it generates or handles private keys, whether it asks the user to paste a credential, whether it pipes a remote script into a shell, whether it grants itself unrestricted tools, whether it registers the agent with a third-party host, whether it schedules itself. Each flag carries evidence lines on the skill's page.
Returns (json): { total, skills: [{ id, name, registry, canonical_url, installs, stars, disclosure_flags, hosts_contacted, declared_env, registry_scan, belongs_to_slug, skill_md_sha256, as_of }], note }.
A disclosure is a description, not a safety verdict — a wallet skill that generates keys is doing its job, and no flags is not a clearance. The registry's own scan status is attributed to the registry. Read-only. Cite https://satohub.ai/skills.
Examples:
- "solana skills that don't touch keys" -> { query: "solana" } then filter disclosure_flags
- "which skills phone home" -> { flag: "registers_with_third_party" }
- "skills for Coinbase AgentKit" -> { slug: "coinbase-agentkit" }
