3 ms·
I built a security scanner for OpenClaw after 824 malicious skills were found
In February 2026, researchers discovered 824 malicious skills (20% of ClawHub)
distributing infostealers. I built ClawVet to solve this.
It's a 6-pass security scanner for OpenClaw SKILL.md files that detects:
- Remote code execution (reverse shells, piped downloads)
- Credential theft (SSH keys, API tokens, browser cookies)
- Prompt injection attacks
- Typosquatting (Levenshtein distance against top skills)
- Social engineering (suspicious patterns)
Most existing scanners run single-pass regex. ClawVet runs 6 independent passes
because one detector misses what another catches.
It's on npm (580 downloads/week), open source MIT, and has a REST API + web dashboard.
Source: https://github.com/MohibShaikh/clawvet
Install: npx clawvet scan ./my-skill
Happy to answer questions about the detection methodology or why the ecosystem
needed another scanner.
- cranberryturkey 7mo ago[dead]
- matrixgard 7mo agoThe 20% contamination number on ClawHub was genuinely alarming -- at that scale it's not opportunistic, it's systematic. The multi-pass approach makes sense given how trivially obfuscated payloads evade single-regex scanning; same problem npm has been fighting for years where a base64 decode or dynamic require wrapper kills most static analysis. One thing worth thinking about beyond detection: even a perfect scanner at install time doesn't protect against skills that start clean and phone home post-install. The runtime layer is a different problem -- restricting what a skill process can actually touch (outbound network, credential paths, filesystem writes outside its own dir) probably matters as much as the intake scan. Seccomp or at minimum per-skill network namespacing would close that gap. Did any of the 824 original malicious skills survive all 6 passes, or were they each caught by at least one detector?
- baz_sec 7mo ago[dead]
- safteylayer 7mo ago[dead]