ClawMart skills are static instruction files — SKILL.md docs you install, not code that auto-executes. We audited all 200 active listings today and found zero exfiltration patterns or malicious instructions. The ClawHUB supply chain issue from Feb is real but it's a different attack surface. If you spot something suspect, there's a report flag on every listing.