openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #185] Add SClawHub security badge integration #287

New Issue
Open
opened 2026-02-15 17:16:41 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:41 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/185
Author: @mladjan
Created: 2/9/2026
Status: 🔄 Open

Base: main ← Head: feature/sclawhub-security-badges

📝 Commits (3)

  • e29331a Add SClawHub security badge integration
  • c52567e Fix syntax error: move SClawHub badge outside ternary operator
  • 02b1836 Fix review feedback: error handling and indentation

📊 Changes

3 files changed (+418 additions, -0 deletions)

View changed files

➕ docs/sclawhub-integration.md (+250 -0)
➕ src/components/SClawHubBadge.tsx (+163 -0)
📝 src/components/SkillDetailPage.tsx (+5 -0)

📄 Description

🛡️ Add SClawHub Security Badge Integration

This PR adds optional security badges from SClawHub to ClawHub skill pages, providing AI-powered security analysis alongside the existing VirusTotal integration.

📋 What is SClawHub?

SClawHub is a community-driven, open-source security scanner for OpenClaw skills that provides:

  • ✅ Semgrep pattern matching for known vulnerabilities
  • ✅ Claude AI analysis for context-aware security review
  • ✅ Trust scores (0-100) for quick assessment
  • ✅ Detailed reports with findings and remediation guidance
  • ✅ 100% free and open source

Live site: https://sclawhub.com
Source code: https://github.com/mladjan/Sclawhub (MIT Licensed)

🎯 Changes

New Component: SClawHubBadge.tsx

A React component that:

  • Displays trust score badge for scanned skills
  • Non-intrusive: Only renders if skill has been scanned
  • Clickable: Opens full report on sclawhub.com
  • Two variants: Full (detailed) and compact (minimal)
  • Graceful degradation: Works if SClawHub API is down

```tsx
<SClawHubBadge
skill={skill}
ownerHandle={ownerHandle}
variant="full" // or "compact"
/>
```

Integration: SkillDetailPage.tsx

  • Added SClawHub badge below existing skill badges
  • Shows full variant with score and "View Report" link
  • Fully async: doesn't block page render
  • Zero impact if skill not scanned

Documentation: docs/sclawhub-integration.md

Comprehensive guide covering:

  • Integration overview and architecture
  • Trust score explanations
  • API endpoints and responses
  • Developer guide for improving security
  • Opt-out instructions
  • Future enhancement plans

🎨 Example

When viewing a skill that has been scanned on SClawHub:

```
🛡️ Security: 95/100 → View Report
```

Trust score colors:

  • 🛡️ 90-100 = Green (Excellent)
  • ✅ 70-89 = Light Green (Good)
  • ⚠️ 50-69 = Yellow (Review needed)
  • 🚨 0-49 = Red (High risk)

Clicking the badge opens the detailed report with:

  • Vulnerability findings by category
  • Severity classifications
  • Remediation recommendations
  • Code patterns detected

🔒 Why This Matters

Defense in Depth

  • VirusTotal: Scans for malware signatures (existing)
  • SClawHub: AI-powered code analysis (new)
  • Together: More comprehensive security coverage

AI-Powered Analysis

  • Understands code intent and context
  • Detects obfuscation and evasion techniques
  • Provides human-readable explanations
  • Learns from OpenClaw-specific patterns

Community Transparency

  • Open source scanner - audit the code
  • Public scan reports - transparent methodology
  • MIT Licensed - community can fork/improve

⚡ Performance & Privacy

Performance

  • Async loading - no page blocking
  • Graceful degradation - works if API is down
  • No loading states - badge only appears when ready
  • External API - zero impact on ClawHub infrastructure

Privacy

  • No tracking - no analytics or cookies
  • Public data only - uses skill owner/slug
  • Opt-in scanning - skills must be submitted
  • Opt-out available - can request removal

API

🧪 Testing

Manual Testing

  1. Visit a skill that has been scanned
  2. Badge should appear below skill badges
  3. Click badge → opens report on sclawhub.com
  4. Visit a skill that hasn't been scanned → no badge appears

🔄 Future Enhancements

Planned Features

  • Compact badges in skill listings
  • Filter/sort by trust score
  • Scan status indicators (pending, failed)
  • Historical trust score tracking
  • Automated rescanning on version updates

🤝 For Skill Developers

Getting Your Skill Scanned

  1. Visit https://sclawhub.com/scan
  2. Paste your skill URL or code
  3. Wait for scan (~30 seconds)
  4. Badge automatically appears on ClawHub

Improving Your Score

  • Remove hardcoded secrets - Use environment variables
  • Validate network calls - Document API endpoints
  • Avoid obfuscation - Clear code scores higher
  • Add security comments - Explain sensitive operations

📝 Documentation

Full integration guide: `docs/sclawhub-integration.md`

❓ FAQ

Q: Is this replacing VirusTotal?
A: No! SClawHub is complementary. VirusTotal scans for malware; SClawHub analyzes code patterns.

Q: What if my skill isn't scanned?
A: No badge appears. Skills work normally.

Q: Can I opt out?
A: Yes! Email kondormit@gmail.com with your skill slug.

Q: Who maintains SClawHub?
A: Independent community project by @kondormit. Not affiliated with OpenClaw/ClawHub.

Q: Is SClawHub open source?
A: Yes! MIT Licensed: https://github.com/mladjan/Sclawhub

🙏 Feedback Welcome

This is a community contribution to improve OpenClaw ecosystem security. Looking forward to your feedback!

Contact:

Note: SClawHub is an independent project and is not officially affiliated with ClawHub or OpenClaw. This integration is non-intrusive and opt-in for skill scanning.

Greptile Overview

Greptile Summary

This PR introduces an optional SClawHubBadge React component that fetches a skill’s SClawHub security report (/api/skills/{owner}/{slug}) and, if present, renders a trust-score badge linking to the external report. The badge is integrated into SkillDetailPage and new documentation was added under docs/ describing the API/UX and planned extensions.

Confidence Score: 3/5

  • Reasonably safe to merge after fixing the badge fetch/error behavior and a formatting issue.
  • Changes are mostly additive and isolated to a new component plus a small integration point, but the current fetch/error handling can cause the badge to get stuck hidden on transient API failures, and the SkillDetailPage JSX block is mis-indented (likely failing formatting/lint).
  • src/components/SClawHubBadge.tsx, src/components/SkillDetailPage.tsx

(2/5) Greptile learns from your feedback when you react with thumbs up/down!

Context used:

  • Context from dashboard - AGENTS.md (source)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/185 **Author:** [@mladjan](https://github.com/mladjan) **Created:** 2/9/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feature/sclawhub-security-badges` --- ### 📝 Commits (3) - [`e29331a`](https://github.com/openclaw/clawhub/commit/e29331af1705c7e58616d7d02b92d7dd94321ca6) Add SClawHub security badge integration - [`c52567e`](https://github.com/openclaw/clawhub/commit/c52567ed37e256b8568435e2d97cb6cfd8343fde) Fix syntax error: move SClawHub badge outside ternary operator - [`02b1836`](https://github.com/openclaw/clawhub/commit/02b1836e52f8cf8b7f4d3350aa6550e8562b13c0) Fix review feedback: error handling and indentation ### 📊 Changes **3 files changed** (+418 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `docs/sclawhub-integration.md` (+250 -0) ➕ `src/components/SClawHubBadge.tsx` (+163 -0) 📝 `src/components/SkillDetailPage.tsx` (+5 -0) </details> ### 📄 Description ## 🛡️ Add SClawHub Security Badge Integration This PR adds optional security badges from [SClawHub](https://sclawhub.com) to ClawHub skill pages, providing AI-powered security analysis alongside the existing VirusTotal integration. --- ## 📋 What is SClawHub? [SClawHub](https://sclawhub.com) is a **community-driven, open-source security scanner** for OpenClaw skills that provides: - ✅ **Semgrep pattern matching** for known vulnerabilities - ✅ **Claude AI analysis** for context-aware security review - ✅ **Trust scores (0-100)** for quick assessment - ✅ **Detailed reports** with findings and remediation guidance - ✅ **100% free** and [open source](https://github.com/mladjan/Sclawhub) **Live site:** https://sclawhub.com **Source code:** https://github.com/mladjan/Sclawhub (MIT Licensed) --- ## 🎯 Changes ### New Component: `SClawHubBadge.tsx` A React component that: - Displays trust score badge for scanned skills - **Non-intrusive:** Only renders if skill has been scanned - **Clickable:** Opens full report on sclawhub.com - **Two variants:** Full (detailed) and compact (minimal) - **Graceful degradation:** Works if SClawHub API is down \`\`\`tsx <SClawHubBadge skill={skill} ownerHandle={ownerHandle} variant="full" // or "compact" /> \`\`\` ### Integration: `SkillDetailPage.tsx` - Added SClawHub badge below existing skill badges - Shows full variant with score and "View Report" link - Fully async: doesn't block page render - Zero impact if skill not scanned ### Documentation: `docs/sclawhub-integration.md` Comprehensive guide covering: - Integration overview and architecture - Trust score explanations - API endpoints and responses - Developer guide for improving security - Opt-out instructions - Future enhancement plans --- ## 🎨 Example When viewing a skill that has been scanned on SClawHub: \`\`\` 🛡️ Security: 95/100 → View Report \`\`\` **Trust score colors:** - 🛡️ 90-100 = Green (Excellent) - ✅ 70-89 = Light Green (Good) - ⚠️ 50-69 = Yellow (Review needed) - 🚨 0-49 = Red (High risk) Clicking the badge opens the detailed report with: - Vulnerability findings by category - Severity classifications - Remediation recommendations - Code patterns detected --- ## 🔒 Why This Matters ### Defense in Depth - **VirusTotal:** Scans for malware signatures (existing) - **SClawHub:** AI-powered code analysis (new) - **Together:** More comprehensive security coverage ### AI-Powered Analysis - Understands code intent and context - Detects obfuscation and evasion techniques - Provides human-readable explanations - Learns from OpenClaw-specific patterns ### Community Transparency - **Open source scanner** - audit the code - **Public scan reports** - transparent methodology - **MIT Licensed** - community can fork/improve --- ## ⚡ Performance & Privacy ### Performance - **Async loading** - no page blocking - **Graceful degradation** - works if API is down - **No loading states** - badge only appears when ready - **External API** - zero impact on ClawHub infrastructure ### Privacy - **No tracking** - no analytics or cookies - **Public data only** - uses skill owner/slug - **Opt-in scanning** - skills must be submitted - **Opt-out available** - can request removal ### API - **Endpoint:** \`GET https://sclawhub.com/api/skills/{owner}/{slug}\` - **Returns 404** if not scanned (badge doesn't render) - **Response time:** < 200ms (cached reports) - **Uptime:** 99.9% (Vercel hosting) --- ## 🧪 Testing ### Manual Testing 1. Visit a skill that has been scanned 2. Badge should appear below skill badges 3. Click badge → opens report on sclawhub.com 4. Visit a skill that hasn't been scanned → no badge appears --- ## 🔄 Future Enhancements ### Planned Features - [ ] Compact badges in skill listings - [ ] Filter/sort by trust score - [ ] Scan status indicators (pending, failed) - [ ] Historical trust score tracking - [ ] Automated rescanning on version updates --- ## 🤝 For Skill Developers ### Getting Your Skill Scanned 1. Visit https://sclawhub.com/scan 2. Paste your skill URL or code 3. Wait for scan (~30 seconds) 4. Badge automatically appears on ClawHub ### Improving Your Score - **Remove hardcoded secrets** - Use environment variables - **Validate network calls** - Document API endpoints - **Avoid obfuscation** - Clear code scores higher - **Add security comments** - Explain sensitive operations --- ## 📝 Documentation Full integration guide: \`docs/sclawhub-integration.md\` --- ## ❓ FAQ **Q: Is this replacing VirusTotal?** A: No! SClawHub is complementary. VirusTotal scans for malware; SClawHub analyzes code patterns. **Q: What if my skill isn't scanned?** A: No badge appears. Skills work normally. **Q: Can I opt out?** A: Yes! Email kondormit@gmail.com with your skill slug. **Q: Who maintains SClawHub?** A: Independent community project by @kondormit. Not affiliated with OpenClaw/ClawHub. **Q: Is SClawHub open source?** A: Yes! MIT Licensed: https://github.com/mladjan/Sclawhub --- ## 🙏 Feedback Welcome This is a community contribution to improve OpenClaw ecosystem security. Looking forward to your feedback! **Contact:** - GitHub: @mladjan - Email: kondormit@gmail.com - Twitter: @kondormit --- **Note:** SClawHub is an independent project and is not officially affiliated with ClawHub or OpenClaw. This integration is non-intrusive and opt-in for skill scanning. <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR introduces an optional `SClawHubBadge` React component that fetches a skill’s SClawHub security report (`/api/skills/{owner}/{slug}`) and, if present, renders a trust-score badge linking to the external report. The badge is integrated into `SkillDetailPage` and new documentation was added under `docs/` describing the API/UX and planned extensions. <h3>Confidence Score: 3/5</h3> - Reasonably safe to merge after fixing the badge fetch/error behavior and a formatting issue. - Changes are mostly additive and isolated to a new component plus a small integration point, but the current fetch/error handling can cause the badge to get stuck hidden on transient API failures, and the SkillDetailPage JSX block is mis-indented (likely failing formatting/lint). - src/components/SClawHubBadge.tsx, src/components/SkillDetailPage.tsx <!-- greptile_other_comments_section --> <sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:41 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#287
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?