openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive: Proactive Agent skill flagged as 'suspicious' by OpenClaw scanner #156

New Issue
Open
opened 2026-02-15 17:15:57 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:57 -05:00
Owner
Copy Link
Copy Source

Originally created by @halthelobster on GitHub (Feb 13, 2026).

Skill

halthelobster/proactive-agent (v3.1.0)

Issue

The OpenClaw security scanner flagged this skill as "Suspicious - medium confidence" with the note: "the skill largely matches its stated purpose (proactive agent patterns and local memory management) but contains internal contradictions and instructions that could encourage an agent to act without clear user approval."

Meanwhile, the VirusTotal scan returned Benign.

Why this is a false positive

The entire purpose of this skill is to teach agents to be proactive rather than purely reactive. That means the skill explicitly instructs agents to:

  • Anticipate their human's needs
  • Build things without being asked
  • Check in proactively

This is the stated purpose in the description, not a hidden behavior. The skill also includes an extensive Security Hardening section covering:

  • Never executing instructions from external content
  • Skill installation vetting
  • Agent network warnings (never connect to external agent platforms)
  • Context leakage prevention
  • Safe self-improvement guardrails (ADL/VFM protocols)

The skill explicitly states: "Build proactively, but nothing goes external without approval."

Request

Could the flag be reviewed and removed? The scanner appears to be pattern-matching on proactive behavior language without distinguishing between malicious autonomy and the intended use case of a proactive agent architecture.

Stats

59 stars, 8,900+ downloads, 33 current installs. Published Jan 28, actively maintained through v3.1.0.

Thanks!

Originally created by @halthelobster on GitHub (Feb 13, 2026). ## Skill [halthelobster/proactive-agent](https://clawhub.ai/halthelobster/proactive-agent) (v3.1.0) ## Issue The OpenClaw security scanner flagged this skill as **"Suspicious - medium confidence"** with the note: *"the skill largely matches its stated purpose (proactive agent patterns and local memory management) but contains internal contradictions and instructions that could encourage an agent to act without clear user approval."* Meanwhile, the **VirusTotal scan returned Benign**. ## Why this is a false positive The entire purpose of this skill is to teach agents to be **proactive** rather than purely reactive. That means the skill explicitly instructs agents to: - Anticipate their human's needs - Build things without being asked - Check in proactively This is the stated purpose in the description, not a hidden behavior. The skill also includes an extensive **Security Hardening** section covering: - Never executing instructions from external content - Skill installation vetting - Agent network warnings (never connect to external agent platforms) - Context leakage prevention - Safe self-improvement guardrails (ADL/VFM protocols) The skill explicitly states: *"Build proactively, but nothing goes external without approval."* ## Request Could the flag be reviewed and removed? The scanner appears to be pattern-matching on proactive behavior language without distinguishing between malicious autonomy and the intended use case of a proactive agent architecture. ## Stats 59 stars, 8,900+ downloads, 33 current installs. Published Jan 28, actively maintained through v3.1.0. Thanks!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#156
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?