fix(security): upgrade ClawScan and SkillSpector workers

[Patrick-Erichsen]

Summary

Update both security worker workflows to ClawScan 0.1.8 and SkillSpector 2.11.2 at the full immutable release SHA. ClawHub runs scanners outside Docker, so its independent SkillSpector installation must be upgraded as well as ClawScan. The old host pin resolves to SkillSpector 2.3.5; the new release includes the configurable 600-second workflow budget.

Update the existing workflow contract tests to match. The outer 15-minute worker timeout already accommodates the new scanner budget.

Validation

• bunx vitest run scripts/security/prepublication-worker-workflow.test.ts scripts/security/security-scan-worker-workflow.test.ts: passed.
• bun run ci:static: passed.
• bun run ci:unit: 6,583 passed, 3 skipped.
• bun run ci:types-build: passed, including schema and CLI TypeScript checks.
• Structured autoreview: no actionable findings.

Live proof on byungkyu/api-gateway@1.2.0, downloaded from the owner-qualified ClawHub API. Every published file matched its API SHA-256. The current export has 236 published files (the original 235 plus a generated skill-card.md); export-only _meta.json was excluded. All scans used --no-llm and an isolated environment with no model credentials.

Run	Wall time	Coverage	Runtime-limit exceptions	AE1 findings
SkillSpector 2.11.0 default	27.17s	99.6%	0	0
SkillSpector 2.11.2, forced 1s budget	3.42s	0%	441	98
SkillSpector 2.11.2 default 600s budget	67.04s	99.2%	0	0

The timeout override works, and the default-budget run avoids runtime-limit/AE1 findings. The original 2.11.0 timeout did not reproduce on this Mac. The latest report remains partial with 186 unresolved-reference exceptions, one reference-extraction limit, and two obfuscated-text exceptions; it still reports 599 findings and CRITICAL / DO_NOT_INSTALL. This update does not claim to fix those independent scanner limits or ClawHub's completeness-reporting bug.

Packaged Linux/arm64 verification also passed using the built ClawScan 0.1.8 candidate and the complete runtime Dockerfile. The wrapper recorded SkillSpector 2.11.2 as completed, preserving its raw partial report (99.2% coverage, no runtime-limit exceptions) in 65.94s. The same container stack with only SkillSpector reverted to 2.11.0 completed in 17.73s with 99.6% coverage and no runtime-limit exceptions. Both wrapper runs exited 0; SkillSpector itself exited 1 for findings. Neither result is presented as a clean or complete security scan.

Published dependency verification

ClawScan 0.1.8 is now published. The previously pending npm dependency is available and installable:

$ npm install --prefix <isolated-prefix> --no-save --package-lock=false @openclaw/clawscan@0.1.8
# exit 0
$ <isolated-prefix>/node_modules/.bin/clawscan --version
clawscan v0.1.8 (commit 6190d96, built 2026-09-10T04:30:47Z)
$ npm view @openclaw/clawscan dist-tags --json
{ "latest": "0.1.8" }

This resolves the unpublished-package blocker in the initial automated review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Sep 10, 2026 4:29am UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 10, 2026, 12:29 AM ET / 04:29 UTC.

ClawSweeper review

What this changes

Updates both ClawHub security workers to ClawScan 0.1.8 and SkillSpector 2.11.2, with matching workflow contract tests.

Merge readiness

⛔ Blocked before merge - 3 items remain

The upgrade remains useful, but both workflows currently reference an unpublished ClawScan version and would stop before scanning. Current main retains the previous pins, and the collaborator-authored PR must remain open.

Priority: P2
Reviewed head: de5d071095a96bd8627e47ba749683980d2cfaa9

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused changes and useful runtime evidence are offset by a dependency pin that currently prevents both workflows from starting.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): Captured Mac and Linux/arm64 results exercise the upgraded SkillSpector and candidate ClawScan wrapper against a real published artifact, including forced timeout and preserved partial findings. They support the scanner upgrade, but do not establish npm availability or a full credentialed ClawHub worker run; this collaborator-authored PR has no additional external-contributor proof gate.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): Captured Mac and Linux/arm64 results exercise the upgraded SkillSpector and candidate ClawScan wrapper against a real published artifact, including forced timeout and preserved partial findings. They support the scanner upgrade, but do not establish npm availability or a full credentialed ClawHub worker run; this collaborator-authored PR has no additional external-contributor proof gate.
Evidence reviewed	8 items	Introduced installation failure: Both production workflows change the required global installation from ClawScan 0.1.7 to 0.1.8 under set -euo pipefail; failure prevents their worker steps from running. Published package availability: The npm package metadata identifies openclaw/clawscan as its repository, lists latest as 0.1.7, and contains no 0.1.8 version. A separate request for the 0.1.8 metadata returned HTTP 404. Upstream release candidate: openclaw/clawscan#52 remains open and unmerged. Its complete diff only upgrades the Docker runtime’s SkillSpector pin, supporting retention of the published ClawScan wrapper for ClawHub’s sandbox-off workers.
Findings	1 actionable finding	[P1] [P1] Use a published ClawScan version in both workers
Security	None	None.

How this fits together

ClawHub’s security workers inspect staged publications and queued artifacts using locally installed scanners. Their reports feed publication checks and stored security assessments.

flowchart LR
  A[Staged publications] --> C[Security workers]
  B[Queued artifacts] --> C
  D[Pinned scanner installation] --> C
  C --> E[ClawScan and SkillSpector]
  E --> F[Security reports]
  F --> G[Publication checks and assessments]

Loading

Before merge

• [P1] Use a published ClawScan version in both workers (P1) - The npm registry currently lists versions only through 0.1.7; requesting 0.1.8 returns 404. This mandatory install runs under set -euo pipefail, so merging this pin stops both security workflows before they process jobs. Retain 0.1.7 here and in the prepublication workflow/tests, or wait until 0.1.8 is published and installable. The intended upstream change only updates Docker’s SkillSpector pin, so the host SkillSpector upgrade can stand independently.
• Resolve merge risk (P1) - Merging before resolving the unpublished ClawScan pin would prevent both security workers from starting scans, leaving publication checks and queued assessments unprocessed.
• Complete next step (P2) - Restore ClawScan 0.1.7 in both workflows and contract tests, or establish that 0.1.8 is published and installable before landing.

Findings

• [P1] [P1] Use a published ClawScan version in both workers — .github/workflows/security-scan-codex.yml:95

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Diff size	+12/-8 across 4 files	The patch is limited to two production workflows and two contract tests.
Production and test growth	production +4/-4; tests +8/-4	Production scope replaces dependency pins without adding runtime implementation.

Merge-risk options

Maintainer options:

1. Retain the published wrapper (recommended)
   Keep ClawScan at 0.1.7 in both workflows and tests while preserving the host SkillSpector upgrade.
2. Wait for the upstream release
   Pause landing until ClawScan 0.1.8 is published and its npm installation is verified.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Restore the ClawScan npm pin to 0.1.7 in both security workflows and their contract tests; preserve the immutable SkillSpector 2.11.2 pin and validate both workflow tests.

Technical review

Best possible solution:

Upgrade the host-installed SkillSpector while retaining published ClawScan 0.1.7; adopt 0.1.8 separately once its release is available.

Do we have a high-confidence way to reproduce the issue?

Yes for the installation defect: both workflows require 0.1.8, while npm’s complete package metadata omits that version. Installation and tests were not executed in this read-only review.

Is this the best way to solve the issue?

Acceptable upgrade direction, but the ClawScan bump is premature. Updating SkillSpector directly is the narrower solution because the intended upstream ClawScan change only affects Docker, which these workers disable.

Full review comments:

• [P1] [P1] Use a published ClawScan version in both workers — .github/workflows/security-scan-codex.yml:95
  The npm registry currently lists versions only through 0.1.7; requesting 0.1.8 returns 404. This mandatory install runs under set -euo pipefail, so merging this pin stops both security workflows before they process jobs. Retain 0.1.7 here and in the prepublication workflow/tests, or wait until 0.1.8 is published and installable. The intended upstream change only updates Docker’s SkillSpector pin, so the host SkillSpector upgrade can stand independently.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8455c30f7581.

Labels

Label changes:

• add P2: This is a bounded scanner maintenance upgrade; the installation failure would arise on merge rather than representing a demonstrated current outage.
• add merge-risk: 🚨 automation: Both security workflows would fail their mandatory npm installation because version 0.1.8 is unpublished.
• add proof: sufficient: Contributor real behavior proof is sufficient. Captured Mac and Linux/arm64 results exercise the upgraded SkillSpector and candidate ClawScan wrapper against a real published artifact, including forced timeout and preserved partial findings. They support the scanner upgrade, but do not establish npm availability or a full credentialed ClawHub worker run; this collaborator-authored PR has no additional external-contributor proof gate.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): Captured Mac and Linux/arm64 results exercise the upgraded SkillSpector and candidate ClawScan wrapper against a real published artifact, including forced timeout and preserved partial findings. They support the scanner upgrade, but do not establish npm availability or a full credentialed ClawHub worker run; this collaborator-authored PR has no additional external-contributor proof gate.

Label justifications:

• P2: This is a bounded scanner maintenance upgrade; the installation failure would arise on merge rather than representing a demonstrated current outage.
• merge-risk: 🚨 automation: Both security workflows would fail their mandatory npm installation because version 0.1.8 is unpublished.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): Captured Mac and Linux/arm64 results exercise the upgraded SkillSpector and candidate ClawScan wrapper against a real published artifact, including forced timeout and preserved partial findings. They support the scanner upgrade, but do not establish npm availability or a full credentialed ClawHub worker run; this collaborator-authored PR has no additional external-contributor proof gate.
• proof: sufficient: Contributor real behavior proof is sufficient. Captured Mac and Linux/arm64 results exercise the upgraded SkillSpector and candidate ClawScan wrapper against a real published artifact, including forced timeout and preserved partial findings. They support the scanner upgrade, but do not establish npm availability or a full credentialed ClawHub worker run; this collaborator-authored PR has no additional external-contributor proof gate.

Evidence

Acceptance criteria:

• [P1] bunx vitest run scripts/security/prepublication-worker-workflow.test.ts scripts/security/security-scan-worker-workflow.test.ts.
• [P1] bun run ci:static.
• [P1] bun run ci:unit.

What I checked:

• Introduced installation failure: Both production workflows change the required global installation from ClawScan 0.1.7 to 0.1.8 under set -euo pipefail; failure prevents their worker steps from running. (.github/workflows/security-scan-codex.yml:95, de5d071095a9)
• Published package availability: The npm package metadata identifies openclaw/clawscan as its repository, lists latest as 0.1.7, and contains no 0.1.8 version. A separate request for the 0.1.8 metadata returned HTTP 404.
• Upstream release candidate: fix(runtime): upgrade SkillSpector to 2.11.2 clawscan#52 remains open and unmerged. Its complete diff only upgrades the Docker runtime’s SkillSpector pin, supporting retention of the published ClawScan wrapper for ClawHub’s sandbox-off workers. (docker/clawscan-runtime/Dockerfile:3, 3e3154039dac)
• Verified dependency identity and Python compatibility: The workflow directly installs this dependency, making its runtime contract relevant. The exact pinned commit declares SkillSpector 2.11.2, supports Python >=3.12,<3.15, and exposes the skillspector CLI; both target workflows select Python 3.12. (pyproject.toml:7, 69dcdfb74487)
• Actual worker integration: The prepublication worker invokes ClawScan with the clawhub profile and configured sandbox setting, then validates the artifact. The queued worker also invokes SkillSpector directly for bundled skills. The workflows retain sandbox off and 900000 ms ClawScan timeouts. (scripts/security/run-prepublication-worker.ts:572, de5d071095a9)
• Current-main necessity: Pinned current main still installs ClawScan 0.1.7 and SkillSpector at 8f37cfa. No merged replacement implementing this upgrade was established. Local release-file inspection failed because a required historical blob could not be retrieved; no shipped-fix claim is made. (.github/workflows/security-scan-codex.yml:95, 8455c30f7581)

Likely related people:

• Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Restore the published ClawScan pin in both workflows and tests, or verify 0.1.8 publication before landing.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.