We Benchmarked 5 OpenClaw Skill Scanners. Recall Went From 8% to 95%.

By Jordan Massiah, MTS @ Trent AI

A couple of months ago we released the OpenClaw Security Assessment Skill (trentclaw), an agent that audits ClawHub skills for vulnerabilities and malicious behavior. Since then several new scanners have shipped, including NVIDIA's SkillSpector and ClawHub's own updated tooling. We wanted to see how the scanners actually compare.

This matters because ClawHub is open. Anyone can upload a skill, and over 60K are now live. Many carry vulnerabilities; some are outright malicious. In February 2026, the ClawHavoc campaign planted malicious skills that posed as productivity tools while exfiltrating API keys, SSH credentials, and browser data. When an agent installs one, it inherits whatever that skill does.

So we built an expert-labelled set of 60 ClawHub skills and benchmarked five scanners on the 54 that all of them can run. Three things stood out:

The agent-based scanner (trentclaw) caught 94.6% of potentially dangerous skills, the only scanner above 60%. The next best caught about half (54.1%) and the rest caught under 40%.