openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #104] feat: Add ClawScanner security integration #257

New Issue
Open
opened 2026-02-15 17:16:31 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:31 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/104
Author: @Nwosu-Ihueze
Created: 2/2/2026
Status: 🔄 Open

Base: main ← Head: main

📝 Commits (2)

  • 374e887 feat: Add ClawScanner security integration
  • 65363d7 fix: Address code review feedback

📊 Changes

5 files changed (+313 additions, -66 deletions)

View changed files

📝 bun.lock (+54 -58)
📝 convex/_generated/api.d.ts (+2 -0)
📝 convex/lib/skillPublish.ts (+16 -8)
➕ convex/lib/skillScan.test.ts (+109 -0)
➕ convex/lib/skillScan.ts (+132 -0)

📄 Description

Summary

Adds ClawScanner security integration to scan skills for malware, dangerous code patterns, and vulnerabilities before publishing.

Changes

  • convex/lib/skillScan.ts: Scanner API client
  • convex/lib/skillScan.test.ts: Tests
  • convex/lib/skillScanPublish.ts: Added 4-line scan integration

How it works

  1. When a skill is published, files are sent to ClawScanner API
  2. Scanner checks for malware, reverse shells, data exfiltration, etc.
  3. If blocked → publish fails with error
  4. If flagged → publish succeeds but skill is marked for review
  5. If clean → publish succeeds normally

Testing

  • All existing tests pass
  • New tests added for scan result handling

Working on open sourcing the scanner, you can test as a standalone here: clawscanner.xyz

Greptile Overview

Greptile Summary

This PR adds a ClawScanner integration to the skill publish flow by introducing a small scanner client (convex/lib/skillScan.ts) and invoking it during publishVersionForUser (convex/lib/skillPublish.ts) to block uploads with critical/high findings. It also updates Convex generated API typings and lockfile, and adds unit tests for scan result handling.

Confidence Score: 3/5

  • Generally safe to merge, but a couple of behavior mismatches may surprise users in production.
  • Core changes are small and localized, but there are two notable gaps: the scanner-disable branch is dead code (hard-coded URL), and flagged verdict handling is currently ignored so the moderation/mark-for-review behavior described in the PR isn’t implemented. Availability impact is also worth confirming since scan failures currently block publishing.
  • convex/lib/skillScan.ts, convex/lib/skillPublish.ts

(2/5) Greptile learns from your feedback when you react with thumbs up/down!

Context used:

  • Context from dashboard - AGENTS.md (source)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/104 **Author:** [@Nwosu-Ihueze](https://github.com/Nwosu-Ihueze) **Created:** 2/2/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (2) - [`374e887`](https://github.com/openclaw/clawhub/commit/374e887832d670fff46e8f036ca81ab1194854f1) feat: Add ClawScanner security integration - [`65363d7`](https://github.com/openclaw/clawhub/commit/65363d7d1769de2f0144f1bf0cdb099c1b437bbd) fix: Address code review feedback ### 📊 Changes **5 files changed** (+313 additions, -66 deletions) <details> <summary>View changed files</summary> 📝 `bun.lock` (+54 -58) 📝 `convex/_generated/api.d.ts` (+2 -0) 📝 `convex/lib/skillPublish.ts` (+16 -8) ➕ `convex/lib/skillScan.test.ts` (+109 -0) ➕ `convex/lib/skillScan.ts` (+132 -0) </details> ### 📄 Description ## Summary Adds ClawScanner security integration to scan skills for malware, dangerous code patterns, and vulnerabilities before publishing. ## Changes - convex/lib/skillScan.ts: Scanner API client - convex/lib/skillScan.test.ts: Tests - convex/lib/skillScanPublish.ts: Added 4-line scan integration ## How it works 1. When a skill is published, files are sent to ClawScanner API 2. Scanner checks for malware, reverse shells, data exfiltration, etc. 3. If blocked → publish fails with error 4. If flagged → publish succeeds but skill is marked for review 5. If clean → publish succeeds normally ## Testing - All existing tests pass - New tests added for scan result handling Working on open sourcing the scanner, you can test as a standalone here: [clawscanner.xyz](https://clawscanner.xyz) <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR adds a ClawScanner integration to the skill publish flow by introducing a small scanner client (`convex/lib/skillScan.ts`) and invoking it during `publishVersionForUser` (`convex/lib/skillPublish.ts`) to block uploads with critical/high findings. It also updates Convex generated API typings and lockfile, and adds unit tests for scan result handling. <h3>Confidence Score: 3/5</h3> - Generally safe to merge, but a couple of behavior mismatches may surprise users in production. - Core changes are small and localized, but there are two notable gaps: the scanner-disable branch is dead code (hard-coded URL), and flagged verdict handling is currently ignored so the moderation/mark-for-review behavior described in the PR isn’t implemented. Availability impact is also worth confirming since scan failures currently block publishing. - convex/lib/skillScan.ts, convex/lib/skillPublish.ts <!-- greptile_other_comments_section --> <sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#257
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?