openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Security skills are getting flagged by the new security audit feature #122

New Issue
Open
opened 2026-02-15 17:15:48 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:48 -05:00
Owner
Copy Link
Copy Source

Originally created by @PaoloRollo on GitHub (Feb 11, 2026).

I've developed this security skill called openclaw-sec and it's getting flagged because it uses in the .ts files for testing purposes (to check that the actual skill works as intended) some malicious strings like rm -rf /.

This is happening for basically all of the security skills developed and available on Clawhub. This is a big security risk, because due to this openclaw bots are not installing or updating such skills, leaving them vulnerable to the some of the attacks this """security audit feature""" is supposed to protect them against.

Please, remove this feature ASAP or change it to something that is not a random AI evaluation, a lot of openclaw bots actively rely on these skills in order to work in a secure environment.

We're not supposed to change our security skills and make them less strong or not re-testeable by developers/agents. This goes against the point of these skills.

Originally created by @PaoloRollo on GitHub (Feb 11, 2026). I've developed this security skill called [openclaw-sec](https://clawhub.ai/PaoloRollo/openclaw-sec) and it's getting flagged because it uses in the .ts files for testing purposes (to check that the actual skill works as intended) some malicious strings like `rm -rf /`. This is happening for basically all of the security skills developed and available on Clawhub. This is a **big security risk**, because due to this openclaw bots are not installing or updating such skills, leaving them vulnerable to the some of the attacks this """security audit feature""" is supposed to protect them against. Please, remove this feature ASAP or change it to something that is not a random AI evaluation, a lot of openclaw bots actively rely on these skills in order to work in a secure environment. We're not supposed to change our security skills and make them less strong or not re-testeable by developers/agents. This goes against the point of these skills.
yindo commented 2026-02-15 17:15:48 -05:00
Author
Owner
Copy Link
Copy Source

@tmchow commented on GitHub (Feb 11, 2026):

Yep, same thing here but for seemingly less egregious reasons. I got my HZL skill flagged by VirusTotal and now OpenClaw is telling me it can't update my own skill:

Skill update was skipped due to a VirusTotal false positive — would need --force to override.
@tmchow commented on GitHub (Feb 11, 2026): Yep, same thing here but for seemingly less egregious reasons. I got my [HZL skill](https://clawhub.ai/tmchow/hzl) flagged by VirusTotal and now OpenClaw is telling me it can't update my own skill: ``` Skill update was skipped due to a VirusTotal false positive — would need --force to override. ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#122
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?