What is NVIDIA SkillSpector?

SkillSpector is an AI-assisted agent skill scanner from NVIDIA that combines static checks with semantic analysis to flag hidden instructions, risky code paths, overbroad capabilities, and mismatches between a skill's declared purpose and actual behavior.

How does SkillSpector compare to VirusTotal for scanning OpenClaw skills?

SkillSpector flagged 48.71% of 67,453 scanned skills as potentially risky, compared to VirusTotal at 7.75% and static analysis at 6.57%. The three scanners barely overlap, with only 0.69% of skills flagged by all three.

What are NVIDIA Skill Cards?

Skill Cards are an open trust-artifact specification that ship with every published OpenClaw skill, documenting who published it, what it can do, what ClawScan found, and exactly where it came from.

Where is the OpenClaw skill security dataset published?

The dataset is published on Hugging Face as OpenClaw/clawhub-security-signals, covering 67,453 latest public skill versions with results from all three scanners.

Why do the three security scanners have such low overlap?

Each scanner targets different risk surfaces: SkillSpector catches semantic and behavioral risks, VirusTotal detects known malware signatures, and static analysis finds code-level issues. No pair agrees on more than 10.4% of combined positives.

← Back to dashboard

clawsmith.com/signal/openclaw-nvidia-skillspector-hugging-face-67k-skill-scan

📈 TrendsWide OpenLive

OpenClaw + NVIDIA Ship SkillSpector AI Scanner: 67,453 Skills Scanned, 48.7% Flagged vs VirusTotal 7.75%

OpenClaw Foundation partners with NVIDIA to release SkillSpector, an AI-assisted agent skill scanner that detects 6.3x more risky skills than VirusTotal. Published 67,453-skill Hugging Face dataset showing minimal overlap between three independent scanners. Skill Cards trust artifacts now ship with every published skill.

Product Idea from this Signal

A runtime middleware that intercepts OpenClaw agent responses before they reach user-facing channels and strips internal thinking blocks, leaked credentials, system prompts, and PII

229 ▲

OpenClaw has a systemic bug where agent internal thinking leaks to users across Discord, Telegram, and webchat (6+ GitHub issues spanning months including P1-rated #64267 with security label). The built-in output-sanitizer skill is opt-in and not automatically applied. Meanwhile 48.7% of ClawHub skills were flagged by NVIDIA SkillSpector scans and ClawMetry (90K installs, 188 PH upvotes) shows demand for agent monitoring. The gap is a drop-in proxy layer that sits in the message pipeline, catches thinking block leaks and credential exposure in real-time, and alerts operators before sensitive content reaches end users.

RUNTIME-MIDDLEWARESECURITYOPEN-SOURCEPROXYOPENCLAW

CompetitiveView Opportunity →