OPENCLAW has announced a partnership with VirusTotal to scan skills uploaded to ClawHub, its skill marketplace, as part of broader efforts to bolster security. The process creates a unique SHA-256 hash for each skill and cross-checks it against VirusTotal’s database; if no match is found, the skill bundle is sent for further analysis using VirusTotal Code Insight.
Skills given a benign Code Insight verdict are automatically approved, while those flagged as suspicious are warned, and any malicious skill is blocked from download; OpenClaw states that all active skills are re-scanned daily. The move comes as researchers have highlighted security issues in the ecosystem, with Bitdefender noting that malicious skills are often cloned and republished with small name variations and payloads staged via paste services.
However, OpenClaw cautions that VirusTotal scanning is not a silver bullet, and some cleverly concealed prompt injections may still slip through the cracks, according to Reuters. Data from Censys shows there are over 30,000 exposed OpenClaw/Moltbot instances online as of February 8, 2026, underscoring the scale of the risk.