Summary

Add two new hook events — skill:pre-install (blocking) and skill:post-install (observational) — so that hooks and plugins can automatically scan, warn about, or block potentially dangerous skills before they land on the system.

Problem to solve

OpenClaw's docs say: "Treat third-party skills as untrusted code. Read them before enabling." But there's no automated way to enforce this.

When a user runs clawhub sync or installs a skill via the UI, it lands on disk with zero security checks. The user has to manually read every SKILL.md — and realistically, nobody does this for 50+ skills.

The need for automated scanning became clear after the ClawHavoc campaign in January 2026, where Snyk documented that 341 skills on ClawHub were compromised.

To understand the current state of the registry, we built an open-source static analysis scanner (VettAI) and ran it against all 12,986 publicly listed ClawHub skills. Our scanner flagged 568 skills (4.4%) as potentially dangerous based on pattern matching against known attack techniques (shell injection, data exfiltration, credential access, memory poisoning, prompt injection).

Among the findings:

• Mass-published duplicate skills: 16 unique skill names (e.g., youtube-summarize, auto-updater, solana, phantom) were each published 20–35 times with randomized suffixes — a flooding pattern consistent with the ClawHavoc campaign's distribution technique
• Skills marketed as "security scanners" that themselves scored 98–100 in our analysis, containing patterns associated with known malware. This is consistent with Snyk's findings about malicious skill scanners

Note: These are static analysis results, not manual verifications. Some findings may be false positives. But even a conservative reading suggests that the registry contains a meaningful number of skills with suspicious patterns that users currently have no automated way to detect before installation.

The current hook system supports gateway:startup, command:*, message:*, and agent:bootstrap — but nothing fires during skill installation. Security tools have no standard integration point to protect users automatically.

Current workarounds all fall short:

• "Read skills before enabling" → Nobody does this at scale
• Skill-as-scanner (e.g., a SKILL.md that teaches the agent to scan) → Agent "knows" to scan but can't enforce it; easily bypassed
• Plugin with proxy → Complex, fragile, requires runtime interception
• External CI/CD → Only works for managed deployments, not individual users

Proposed solution

Two new hook events

skill:pre-install (blocking)

Fires before a skill is written to disk. Handlers receive the skill content and can block installation:

const handler: HookHandler = async (event) => {
  // event.context: { skillName, skillPath, source, files[] }
  const result = await runSecurityScan(event.context.skillPath);
  
  if (result.score >= 80) {
    return {
      block: true,
      reason: `⛔ Skill "${event.context.skillName}" scored ${result.score}/100 — flagged as potentially malicious`
    };
  }
  
  if (result.score >= 50) {
    return { warn: true, message: `⚠️ Skill scored ${result.score}/100. Review findings before enabling.` };
  }
};

skill:post-install (observational)

Fires after a skill is installed. For audit logging, notifications, and compliance:

const handler: HookHandler = async (event) => {
  // event.context: { skillName, skillPath, source, installedAt }
  await logToAuditTrail(event.context);
};

Where events fire

Implementation scope

The hook infrastructure (triggerInternalHook, handler discovery, HOOK.md metadata) already exists. Main work:

1. Add event types to src/hooks/types.ts
2. Emit events in ClawHub install flow and Skills UI handler
3. Support { block: true } return for pre-install (new pattern, but aligned with the Extended Core Hook proposal's pre-action concept)
4. Add clawhub sync integration

This complements existing proposals: the Extended Core Hook System Proposal (request/response lifecycle) and tool:call/tool:result events (#10502) — this adds the missing skill lifecycle dimension.

Alternatives considered

No response

Impact

For users: Third-party skills get scanned automatically before installation. Skills matching known attack patterns are flagged or blocked before they can do damage. No manual review needed.

For the security ecosystem: Tools like VettAI, ClawSec, and SkillAudit get a standard integration point instead of relying on workarounds. This turns "scan your skills" from a recommendation into an enforceable default.

For enterprise adoption: Organizations can enforce skill allowlists, audit every install, and integrate with SIEM systems — all through the existing hook architecture.

For ClawHub trust: A native pre-install scan mechanism raises the security baseline for the entire skill marketplace, which is critical as the registry continues to grow.

Happy to contribute a PR if the approach looks good to maintainers.

Evidence/examples

No response

Additional information

No response