ClawHub 安全信號：當 VirusTotal、靜態分析與 SkillSpector 出現分歧時

摘要

代理技能通過可重複使用的指令、工具、腳本、參考資料和工作流程擴展AI代理，建立了一個獨立於模型安全性與傳統套件惡意軟體偵測的安全邊界。ClawHub Security Signals是一個經過淨化的資料集，包含67,453個最新的公開OpenClaw技能版本。每一行對應經編輯的SKILL.md內容（若有）與經過清理的捆綁檔案，並附上ClawScan註冊表的最終判定，以及來自三個掃描器家族（VirusTotal、靜態啟發式分析與NVIDIA SkillSpector）的證據。我們並非評估惡意技能的普遍性，而是研究掃描器之間的不一致性。三個掃描器極少標記相同的技能：任兩個掃描器在其合計陽性結果中僅有最多10.4%重疊，僅0.69%的技能被所有三個掃描器標記，而81.9%被標記的技能僅由單一掃描器識別。此不一致性與攻擊面結構相關。SkillSpector主要發出語義層級的代理風險警示，而非惡意軟體信譽信號，在25,504個可疑資料列中有19,209列（75.3%）呈陽性，但在206個惡意資料列中僅有14列（6.8%）呈陽性。惡意判定區域則呈現相反輪廓：206個惡意資料列中有150列（72.8%）為VirusTotal陽性，這與捆綁程式碼的惡意軟體證據一致。這些結果顯示，代理技能的安全性需要分層治理，而非單一掃描器的允許/封鎖決策。本語料庫以經過淨化的銀級標準資料集形式釋出：標籤為註冊表自動化判定，而非人工標註的基準真相，且此釋出版本為早期快照，旨在支援社群，同時正在開發人工標註子集。我們鼓勵進一步研究，包括針對技能安全分類量身打造的模型。

English

Agent skills extend AI agents with reusable instructions, tools, scripts, references, and workflows, establishing a security boundary distinct from both model safety and traditional package-malware detection. ClawHub Security Signals is a sanitized dataset of 67,453 latest public OpenClaw skill versions. Each row pairs redacted SKILL.md content and sanitized bundled files where present with a final ClawScan registry verdict and evidence from three scanner families: VirusTotal, static heuristic analysis, and NVIDIA SkillSpector. Rather than estimating malicious-skill prevalence, we study scanner disagreement. The three scanners rarely flag the same skills: any pair overlaps on at most 10.4% of their combined positives, only 0.69% of skills are flagged by all three, and 81.9% of flagged skills are identified by a single scanner. The disagreement is structured by attack surface. SkillSpector, which raises semantic agentic-risk advisories rather than malware-reputation signals, is positive for 19,209 of 25,504 suspicious rows (75.3%) but only 14 of 206 malicious rows (6.8%). The malicious-verdict region shows the inverse profile: 150 of 206 malicious rows (72.8%) are VirusTotal-positive, consistent with bundled-code malware evidence. These results show that agent-skill security requires layered governance, not single-scanner allow/block decisions. The corpus is released as a sanitized silver-standard dataset: labels are the registry's automated verdicts, not human-annotated ground truth, and the release represents an early, versioned snapshot intended to support the community while a human-annotated subset is developed. Further research is encouraged, including models tailored for skill-security triage.