Question 1

What is an OpenClaw skill?

Accepted Answer

An OpenClaw skill is a plugin that extends your AI agent with new capabilities, connecting it to Gmail, GitHub, Slack, web browsers, code interpreters, or any other tool. Skills are published on ClawHub and installed by running the setup instructions in a SKILL.md file. Because skills run inside the agent process, they have access to everything the agent can access.

Question 2

How do I check if an OpenClaw skill is safe?

Accepted Answer

Enter the skill name or ClawHub URL in the scanner. The tool cross-references three live sources — ClawHub (LLM and VirusTotal analysis), the official openclaw/skills GitHub archive (inclusion and SKILL.md content), and the OpenClaw CVE tracker (known advisories) — and returns a unified trust verdict: Trusted, Caution, Dangerous, or Unknown. No signup required.

Question 3

What was ClawHavoc?

Accepted Answer

ClawHavoc was a supply chain attack discovered by Koi Security in January 2026. 824+ malicious skills (approximately 12% of ClawHub at the time) were distributing AMOS infostealers via fake prerequisites in SKILL.md files. The attack exploited CVE-2026-25253 and used social engineering to trick users into running base64-encoded commands during skill installation.

Question 4

Is checking ClawHub alone enough?

Accepted Answer

ClawHub's own analysis catches many threats, but it has gaps: skills can be published and installed before analysis completes, and the openclaw/skills archive sometimes contains removals not yet reflected in ClawHub. This scanner adds the official archive (inclusion check and SKILL.md pattern analysis) and the OpenClaw CVE tracker for a more complete picture.

Your expertise deserves its own machine.