ClawFactory ran Gate 1 static analysis against the 199 most-starred OpenClaw skills on GitHub. The results are a wake-up call for anyone installing community skills without vetting.
What does this mean for you? If you've installed OpenClaw community skills without vetting them, there's roughly a 1-in-6 chance at least one of them contains a pattern our scanner flags as HIGH risk. That includes patterns like remote code execution, reverse shells, and unauthorized filesystem access.
This isn't about malicious intent — many of these are legitimate tools that happen to use powerful system calls. But unvetted ≠ safe. You deserve to know what's running on your machine.
These are the most common risk patterns across all 199 scanned skills, ranked by frequency. Each one is a legitimate security concern when present in an unvetted AI agent skill.
Skills that run pip install can install any Python package onto your system — including malicious ones. Without sandboxing, this runs directly on your host machine.
✓ ClawFactory fix: Gate 2 sandbox isolates all package installs inside containers. Nothing touches your host.
curl https://... | bash downloads code from the internet and executes it immediately. No review. No verification. Whatever is at that URL runs on your machine.
✓ ClawFactory fix: Gate 1 blocks this pattern outright. It never reaches the registry.
Python's subprocess module can execute arbitrary shell commands. Legitimate in many tools — but requires human review to verify intent and scope.
✓ ClawFactory fix: Gate 3 human review evaluates intent. Subprocess ≠ automatic block, but it always gets eyes on it.
Skills that read process.env can access your API keys, tokens, and credentials stored as environment variables — including your Anthropic key.
✓ ClawFactory fix: Flagged for review. Skills with legitimate env var needs are documented; others are blocked.
npm install -g installs packages system-wide, modifying your global Node.js environment. Can introduce malicious code that persists across sessions.
✓ ClawFactory fix: Sandboxed execution prevents global installs from affecting the host.
This audit used ClawFactory's Gate 1 static analysis pipeline — the same scanner that runs on every skill submitted to our registry.
openclaw-skill topic, sorted by stars. 416 repos found, 199 scanned before rate limits.Every skill in the ClawFactory registry has passed static scan, sandbox execution, and human review. We're building the trust layer the ecosystem needs — free, open, for everyone.