OpenClaw, which maintains the ClawScan review tool and ClawHub registry, said it has integrated Tencent’s AI-Infra-Guard into security checks for every skill and plugin uploaded to ClawHub.

OpenClaw said ClawScan runs AIG and Nvidia’s SkillSpector separately, then uses an AI judge to review both tools’ findings alongside the uploaded files.

ClawHub is documented as OpenClaw’s registry for skills and plugins, and its catalog page hosts plugins.

OpenClaw and Tencent evaluated the setup on a fixed 556-case subset of SkillTrustBench, a public benchmark developed by Tencent and the Chinese University of Hong Kong, Shenzhen.

The benchmark measures safety for AI agents exposed to attacks through skills.

OpenClaw said the combined review process matched 86.9% of benchmark labels and correctly classified 98.6% of malicious cases.

It said it now shares anonymized disagreements and confirmed false positives with Tencent to refine AIG’s detection rules and review process.

The update comes amid wider scrutiny of agent extensions, including guidance on securing plugins and OWASP work listing risks for agentic applications.

🔗 Source: OpenClaw

Recent OpenClaw developments