ClawVet

Skill vetting and supply chain security for the OpenClaw ecosystem. ClawVet scans SKILL.md files for prompt injection, credential theft, remote code execution, typosquatting, and social engineering, catching threats that VirusTotal misses. It runs fully offline by default, with an optional AI stage you turn on when you want it.

Demo

A safe skill scores a clean A. A skill that pipes curl to bash and reads your ~/.aws/credentials gets flagged CRITICAL and fails CI.

Reproduce it yourself (Windows PowerShell):

.\demo.ps1            # uses the installed `clawvet` (npm i -g clawvet)
.\demo.ps1 -Local     # uses this repo's build, no global install needed

Why

In Feb 2026 researchers found 824+ malicious skills, around 20% of ClawHub. The “ClawHavoc” campaign distributed infostealers via fake skills. ClawVet runs six independent analysis passes on every skill to catch what single-pass scanners miss.

Quick start

# Install once, then run the copy you installed
npm install -g clawvet

# Scan a local skill
clawvet scan ./my-skill/

# JSON output for CI/CD
clawvet scan ./my-skill/ --format json --fail-on high

# Audit all installed skills
clawvet audit

Install it rather than running npx clawvet. A fresh npx fetch runs whatever version the registry serves at that moment, which is the wrong habit for a tool you use to vet other code. Updating is a deliberate npm update -g clawvet, and every release carries npm provenance you can check first with npm view clawvet dist.attestations.

The CLI is static and offline, so it works in CI with no key and no network, and nothing is sent anywhere. It has no AI pass: semantic analysis runs only in the hosted API, and the CLI rejects --semantic rather than appearing to run it.

Install-time enforcement

clawvet gate is an OpenClaw security.installPolicy hook. OpenClaw stages the source, writes the install metadata to the command’s stdin, and reads back one JSON verdict before the install completes. It runs whether or not an agent remembers to scan anything.

Install clawvet globally once, then print a ready-to-paste config with the paths already resolved:

npm install -g clawvet
clawvet gate --print-config

Do not use npx clawvet gate --print-config. The config embeds resolved paths, and npx resolves them into its cache (~/.npm/_npx/...). A cache cleanup later removes the policy executable the config points at. Every install then fails closed, and the only fix is pasting the config again. A global install is