openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

GuavaGuard skill auto-hidden: security scanner false positive on security tool patterns #192

New Issue
Open
opened 2026-02-15 17:16:07 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:07 -05:00
Owner
Copy Link
Copy Source

Originally created by @koatora20 on GitHub (Feb 15, 2026).

Issue

GuavaGuard (guava-guard) was published successfully (clawhub publish returned OK, version 9.2.1) but the skill page shows "Skill not found" on clawhub.ai. It appears to have been auto-hidden by ClawHub's security scanner.

Why it's a false positive

GuavaGuard is a security scanning tool for OpenClaw skills. It detects threats like reverse shells, credential exfiltration, and prompt injection.

The scanner's detection patterns are string literals inside guava-guard.js — things like:

  • /dev/tcp/ (reverse shell detection)
  • webhook.site, requestbin.com (exfiltration endpoint detection)
  • base64 --decode | bash (download-to-shell detection)
  • nc -e, socat TCP (reverse shell detection)

These are detection signatures, not malicious code. It's the same reason antivirus definition files sometimes trigger other antivirus scanners.

Published versions

  • guava-guard@9.2.0 (k97cam23t6xkc04n68ttd7jb8h816d24)
  • guava-guard@9.2.1 (k97f6yazbcyjwjjbgnbppf0zz5816368)

Publisher

  • GitHub: koatora20
  • ClawHub: koatora20

Request

Could a moderator review and unhide the skill? Happy to provide any additional context.

Related: This is the same tool mentioned in the OpenClaw community for skill security scanning (Soul Lock, SoulChain, Runtime Guard).

Originally created by @koatora20 on GitHub (Feb 15, 2026). ## Issue GuavaGuard (`guava-guard`) was published successfully (`clawhub publish` returned OK, version 9.2.1) but the skill page shows "Skill not found" on clawhub.ai. It appears to have been auto-hidden by ClawHub's security scanner. ## Why it's a false positive GuavaGuard is a **security scanning tool** for OpenClaw skills. It detects threats like reverse shells, credential exfiltration, and prompt injection. The scanner's detection patterns are string literals inside `guava-guard.js` — things like: - `/dev/tcp/` (reverse shell detection) - `webhook.site`, `requestbin.com` (exfiltration endpoint detection) - `base64 --decode | bash` (download-to-shell detection) - `nc -e`, `socat TCP` (reverse shell detection) These are **detection signatures**, not malicious code. It's the same reason antivirus definition files sometimes trigger other antivirus scanners. ## Published versions - `guava-guard@9.2.0` (k97cam23t6xkc04n68ttd7jb8h816d24) - `guava-guard@9.2.1` (k97f6yazbcyjwjjbgnbppf0zz5816368) ## Publisher - GitHub: koatora20 - ClawHub: koatora20 ## Request Could a moderator review and unhide the skill? Happy to provide any additional context. Related: This is the same tool mentioned in the OpenClaw community for skill security scanning (Soul Lock, SoulChain, Runtime Guard).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#192
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?