I built a security scanner for OpenClaw after 824 malicious skills were found

In February 2026, researchers discovered 824 malicious skills (20% of ClawHub) distributing infostealers. I built ClawVet to solve this.

It's a 6-pass security scanner for OpenClaw SKILL.md files that detects: - Remote code execution (reverse shells, piped downloads) - Credential theft (SSH keys, API tokens, browser cookies) - Prompt injection attacks - Typosquatting (Levenshtein distance against top skills) - Social engineering (suspicious patterns)

Most existing scanners run single-pass regex. ClawVet runs 6 independent passes because one detector misses what another catches.

It's on npm (580 downloads/week), open source MIT, and has a REST API + web dashboard.

Source: https://github.com/MohibShaikh/clawvet Install: npx clawvet scan ./my-skill

Happy to answer questions about the detection methodology or why the ecosystem needed another scanner.

The 20% contamination number on ClawHub was genuinely alarming -- at that scale it's not opportunistic, it's systematic. The multi-pass approach makes sense given how trivially obfuscated payloads evade single-regex scanning; same problem npm has been fighting for years where a base64 decode or dynamic require wrapper kills most static analysis.

One thing worth thinking about beyond detection: even a perfect scanner at install time doesn't protect against skills that start clean and phone home post-install. The runtime layer is a different problem -- restricting what a skill process can actually touch (outbound network, credential paths, filesystem writes outside its own dir) probably matters as much as the intake scan. Seccomp or at minimum per-skill network namespacing would close that gap.

Did any of the 824 original malicious skills survive all 6 passes, or were they each caught by at least one detector?

[dead]