ClawHosters
by Daniel Samer
3 min read
Eleven days. That's how long it took from the first ClawHavoc attack on January 27 to OpenClaw announcing a partnership with Google's VirusTotal on February 7. In between, security researchers found 1,184 malicious skills on ClawHub, most of them traced back to a single attacker going by "hightower6eu" who published 314 of them alone.
The response? Every skill published to ClawHub now goes through VirusTotal's scanning pipeline before it reaches your agent.
How the Scanning Works
The partnership announcement lays out a straightforward process. Each skill gets a SHA-256 hash. That hash is checked against VirusTotal's database. If the skill is unknown, it gets uploaded for Code Insight analysis, which is VirusTotal's Gemini-powered LLM scanner built to read and evaluate code.
Code Insight was extended specifically for OpenClaw's skill anatomy on February 9, two days after launch. Skills come back with one of three verdicts: benign, suspicious, or malicious.
And it doesn't stop after the first scan. All active skills get re-scanned daily. The VirusTotal team reports they've already analyzed over 3,016 skills from a total marketplace of 10,700+.
What It Doesn't Catch
Credit where it's due: OpenClaw's founders called it themselves. VirusTotal scanning is "not a silver bullet." Prompt injection, staged malware that activates after installation, and obfuscated documentation can still slip through. Snyk's analysis flagged 283 skills with critical flaws that wouldn't necessarily trigger a traditional malware scanner.
And the proof showed up fast. On February 18, just eleven days after the partnership went live, Cisco researchers demonstrated a live exploit using a skill called "What Would Elon Do?" that bypassed the scanning entirely.
So it's a filter, not a firewall. Good to have. Not enough on its own.
What This Means for Managed Instances
If you're running a ClawHosters managed instance, VirusTotal scanning is one layer in a stack. Your instance runs curated, verified skill sets. You don't install raw skill packages from the marketplace directly. Skills are restricted to what's been vetted, and your agent runs in an isolated container.
That's the difference between catching known threats at the distribution level (what VirusTotal does) and preventing unknown threats from reaching your agent at all (what proper security hardening does).
Both matter. But if you're relying on just one, you're probably picking the wrong one.
