Issues

• Public pages list a package that has no published release

  clawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP2
  openclaw/clawhub#3855 · Filter by author SebTardif opened on Sep 30, 2026
  1

• CLEAN skill @eatmoreduck/boss-zhipin-scraper stuck in pending.publication since 2026-09-26

  clawsweeper:needs-infoclawsweeper:needs-security-reviewclawsweeper:no-new-fix-primpact:otherimpact:securityissue-rating: 🦐 gold shrimpP2
  openclaw/clawhub#3844 · Filter by author eatmoreduck opened on Sep 29, 2026
  1

• Lobster Packs category for LobsterDex discovery

  clawsweeper:linked-pr-openclawsweeper:needs-product-decisionclawsweeper:no-new-fix-primpact:ux-frictionissue-rating: 🌊 off-meta tidepoolP2
  openclaw/clawhub#3836 · Filter by author jjjhenriksen opened on Sep 28, 2026
  1

• [ClawHub] runtimeId repair or hard delete for @psxxo/memory-lancedb-cip (runtimeId locked to memory-lancedb-pro)

  clawsweeper:needs-maintainer-reviewclawsweeper:needs-product-decisionclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP2
  openclaw/clawhub#3819 · Filter by author psxxo opened on Sep 25, 2026
  2

• Public stars tab lists hidden skills

  clawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP1
  openclaw/clawhub#3809 · Filter by author SebTardif opened on Sep 24, 2026
  1

• Concurrent download metrics can double-count

  clawsweeper:not-repro-on-mainimpact:otherissue-rating: 🦪 silver shellfishP3
  openclaw/clawhub#3808 · Filter by author SebTardif opened on Sep 24, 2026
  1

• Concurrent install telemetry can double-count

  impact:otherissue-rating: 🦪 silver shellfishP2
  openclaw/clawhub#3807 · Filter by author SebTardif opened on Sep 24, 2026
  1

• One malformed skills.sh row crashes the mirror page

  clawsweeper:source-reproimpact:otherissue-rating: 🦞 diamond lobsterP2
  openclaw/clawhub#3806 · Filter by author SebTardif opened on Sep 24, 2026
  1

• Security-verdicts API returns unpublished skill scan summaries

  clawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP0security
  openclaw/clawhub#3805 · Filter by author SebTardif opened on Sep 24, 2026
  1

• Org claim: huaweicloudskill

  area: moderationarea: securityclawsweeper:needs-product-decisionclawsweeper:needs-security-reviewclawsweeper:no-new-fix-primpact:securityissue-rating: 🌊 off-meta tidepoolP2status: review
  openclaw/clawhub#3801 · Filter by author huaweicloudskill opened on Sep 24, 2026
  2

• clawhub package publish of a 17 KB code-plugin fails server-side: "Node.js action execution ran out of memory (maximum memory usage: 512 MB)"

  clawsweeper:needs-maintainer-reviewclawsweeper:no-new-fix-primpact:otherissue-rating: 🦪 silver shellfishP2
  openclaw/clawhub#3788 · Filter by author d-mo opened on Sep 20, 2026
  4

• Proposal: third-party "assay-verified" badge for ClawHub cards — we supply, you display

  clawsweeper:needs-maintainer-reviewclawsweeper:needs-product-decisionclawsweeper:needs-security-reviewclawsweeper:no-new-fix-primpact:securityissue-rating: 🌊 off-meta tidepoolP3
  openclaw/clawhub#3787 · Filter by author chunxiaoxx opened on Sep 20, 2026
  2

• @DColl is attempting to deploy a commit to the **Amantus Machina** Team on [Vercel](https://vercel.com).

  issue-rating: 🌊 off-meta tidepoolP3
  openclaw/clawhub#3785 · Filter by author frshyddsjady-dev opened on Sep 19, 2026
  1

• False positive: ClawScan claims @liseman/openclaw-louter 0.2.8 ships Python bytecode, but artifact contains none

  clawsweeper:needs-security-reviewclawsweeper:no-new-fix-primpact:securityissue-rating: 🦪 silver shellfishP2r: rescan-guidance
  openclaw/clawhub#3784 · Filter by author liseman opened on Sep 18, 2026
  2

• RFC: a generic scanner slot, so a fourth verdict source does not need a schema migration

  clawsweeper:needs-product-decisionclawsweeper:no-new-fix-primpact:securityissue-rating: 🌊 off-meta tidepoolP3
  openclaw/clawhub#3783 · Filter by author MoltyCel opened on Sep 18, 2026
  1

• Official multi-platform plugin cannot publish under ClawPack unpacked-size limit

  clawsweeper:needs-product-decisionclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP2
  openclaw/clawhub#3782 · Filter by author shalim786 opened on Sep 18, 2026
  1

• Possible false positive: loopback browser host permission classified as an untrusted install source

  clawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP2r: rescan-guidancesecurity
  openclaw/clawhub#3778 · Filter by author schchit opened on Sep 17, 2026
  2

• Unauthenticated action can enqueue catalog-wide VirusTotal and LLM scans

  clawsweeper:bulk-filedclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP0stale
  openclaw/clawhub#3773 · Filter by author SebTardif opened on Sep 16, 2026
  3

• Unauthenticated action can rewrite catalog plugin scanStatus

  clawsweeper:bulk-filedclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP0stale
  openclaw/clawhub#3772 · Filter by author SebTardif opened on Sep 16, 2026
  3

• Revoking a skill latest can publish a pending version as latest

  clawsweeper:bulk-filedclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP2stale
  openclaw/clawhub#3769 · Filter by author SebTardif opened on Sep 16, 2026
  3

• Official catalog can advertise an unpublished plugin version after quarantine

  clawsweeper:bulk-filedclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP2stale
  openclaw/clawhub#3768 · Filter by author SebTardif opened on Sep 16, 2026
  3

• Unauthenticated mutation can requeue NVIDIA skill evaluations

  clawsweeper:bulk-filedclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP0stale
  openclaw/clawhub#3761 · Filter by author SebTardif opened on Sep 16, 2026
  3

• Dashboard download metrics treat any caller as a legacy personal owner

  clawsweeper:bulk-filedclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP0stale
  openclaw/clawhub#3759 · Filter by author SebTardif opened on Sep 16, 2026
  3

• HTTP skill owner checks ignore current org membership

  clawsweeper:bulk-filedclawsweeper:needs-security-reviewclawsweeper:no-new-fix-prclawsweeper:source-reproimpact:securityissue-rating: 🦞 diamond lobsterP0stale
  openclaw/clawhub#3757 · Filter by author SebTardif opened on Sep 16, 2026
  3

• Structural audit layer: a complement to payload scanning (open source)

  clawsweeper:needs-maintainer-reviewclawsweeper:needs-product-decisionclawsweeper:no-new-fix-primpact:securityissue-rating: 🌊 off-meta tidepoolP3stale
  openclaw/clawhub#3689 · Filter by author chenhz01 opened on Sep 12, 2026
  3