ClawHub安全信号：当VirusTotal、静态分析与SkillSpector存在分歧时

摘要

ClawHub 安全信号是一个经过清洗的数据集，包含 67,453 个最新的公开 OpenClaw 技能版本。每行数据将经过处理的 SKILL.md 内容与清理后的捆绑文件（如有）配对，并附上最终的 ClawScan 注册表判决结果，以及来自三种扫描器系列（VirusTotal、静态启发式分析、NVIDIA SkillSpector）的证据。我们并非估算恶意技能的流行程度，而是研究扫描器之间的分歧。三种扫描器很少针对同一技能发出告警：任意两个扫描器在其合并阳性结果上的重叠比例不超过 10.4%，仅 0.69% 的技能被三种扫描器同时标记，而 81.9% 的被标记技能仅由单一扫描器识别。这种分歧与攻击面具有结构性关联。SkillSpector 发出的是语义层面代理风险评估告警，而非恶意软件信誉信号，其在 25,504 个可疑行中检出 19,209 个阳性（75.3%），但在 206 个恶意行中仅检出 14 个阳性（6.8%）。恶意判决区域呈现相反的分布特征：206 个恶意行中有 150 个（72.8%）为 VirusTotal 阳性，与捆绑代码中的恶意软件证据一致。这些结果表明，代理技能安全需要分层治理，而非单一扫描器的允许/阻止决策。该语料库以清洗后的银标准数据集形式发布：标签为注册表的自动化判决，而非人工标注的真实基础，此次发布代表一个早期版本快照，旨在支持社区发展，同时人工标注子集正在建设中。鼓励进一步研究，包括为技能安全分类量身定制的模型。

English

Agent skills extend AI agents with reusable instructions, tools, scripts, references, and workflows, establishing a security boundary distinct from both model safety and traditional package-malware detection. ClawHub Security Signals is a sanitized dataset of 67,453 latest public OpenClaw skill versions. Each row pairs redacted SKILL.md content and sanitized bundled files where present with a final ClawScan registry verdict and evidence from three scanner families: VirusTotal, static heuristic analysis, and NVIDIA SkillSpector. Rather than estimating malicious-skill prevalence, we study scanner disagreement. The three scanners rarely flag the same skills: any pair overlaps on at most 10.4% of their combined positives, only 0.69% of skills are flagged by all three, and 81.9% of flagged skills are identified by a single scanner. The disagreement is structured by attack surface. SkillSpector, which raises semantic agentic-risk advisories rather than malware-reputation signals, is positive for 19,209 of 25,504 suspicious rows (75.3%) but only 14 of 206 malicious rows (6.8%). The malicious-verdict region shows the inverse profile: 150 of 206 malicious rows (72.8%) are VirusTotal-positive, consistent with bundled-code malware evidence. These results show that agent-skill security requires layered governance, not single-scanner allow/block decisions. The corpus is released as a sanitized silver-standard dataset: labels are the registry's automated verdicts, not human-annotated ground truth, and the release represents an early, versioned snapshot intended to support the community while a human-annotated subset is developed. Further research is encouraged, including models tailored for skill-security triage.