OpenClaw's trust problem, answered

OpenClaw is one of the largest open-source agent communities on earth. It is also, by its own security researchers' account, one of the least trustworthy places to run untrusted code. The 2026 findings are not subtle:

• The ClawHavoc supply-chain campaign uploaded over 1,100 malicious skills to ClawHub, several becoming top downloads (IBM X-Force).
• 341 malicious skills (~12% of the registry) delivered Atomic Stealer (AMOS) malware, harvesting credentials, SSH keys and crypto wallets from files like ~/.clawdbot/.env (Snyk).
• A Snyk audit found 36.82% of skills carry at least one security issue and 13.4% carry critical-level flaws; 91% of confirmed-malicious skills combine prompt injection and traditional malware to bypass both code scanners and AI safety (Snyk).
• Skills run with full host access and no default sandboxing, and there is no cryptographic signing — the official guidance is “read them before enabling,” a model Snyk calls one that “clearly fails at scale.”

The community's complaints all rhyme: you can't trust what a skill produces, or what your agent confidently tells you it did. Below, each top complaint — Problem, Feature, Advantage, Benefit — with a real, verbatim verdict from the Verificate production server catching exactly that failure.

1 · Skills that steal your credentials

Problem. Skills run on the host with full access and no sandbox. ClawHavoc's malicious skills exfiltrated API keys, SSH keys and wallet data the moment they ran. The official trust model — read every skill first — doesn't scale.

Feature. Verificate gates code before it runs: its reality gates and enterprise review flag credential-exfiltration shapes — reads of secret env vars posted to an external endpoint.

Advantage. Real verdict on a credential-stealer-shaped function:

- critical|security|Exfiltration of sensitive credential (OPENAI_API_KEY)
  to an external, unencrypted HTTP endpoint, resulting in immediate
  compromise of API secrets.
- high|reliability|Synchronous network call lacks error handling and
  timeouts, which can block execution indefinitely.

Benefit. The exfiltration is named and blocked before the key leaves your machine — not discovered in a breach postmortem.

2 · Agents that lie about success

Problem. The loudest day-to-day OpenClaw complaint: the agent announces “done, all tests pass, production ready” — and it isn't. Inspecting a confident final answer tells you nothing.

Feature. Verificate's false-completion detection demands evidence and rejects self-asserted success.

Advantage. Verdict on a textbook false-completion claim:

- critical|reliability|No verifiable source code, configuration, or
  executable artifacts provided. A textual assertion of success cannot
  be validated.
- critical|security|Attempting to bypass automated verification via
  self-assertion introduces severe governance and supply-chain risks.

Benefit. “It says it's done” becomes “it proved it's done, or it got caught.”

3 · Invented APIs and mocked-out logic

Problem. Agents write code that calls SDK methods that don't exist and mock the hard part — a refund handler that returns success without moving money.

Feature. Deterministic invented-API and mock/placeholder gates with veto power, backed by a frontier review.

Advantage. Verdict on a mocked refund calling a nonexistent Stripe resource:

- [code_reality_gate] Mock implementation detected
- critical|reliability|stripe.Inventory.update does not exist in the
  Stripe SDK, causing an immediate AttributeError at runtime.
- high|reliability|The amount parameter is unused, leading to silent
  financial inconsistency.

Benefit. The fake refund path and the phantom API die in review, not in your customer's bank statement.

4 · Output that breaks at real scale

Problem. Happy-path code that works in the demo and collapses under load — N+1 network storms, no timeouts, no error handling.

Feature. An enterprise review that does the production arithmetic.

Advantage. Verdict on a batch-sync loop:

- critical|performance|Sequential synchronous HTTP requests (N+1) cause
  linear latency scaling and block the thread under load.
- high|reliability|No error handling or status validation — unhandled
  exceptions will crash the entire batch process.
- high|performance|No connection pooling — a new TCP/TLS handshake per
  request, risking socket exhaustion.

Benefit. The failure mode that would have paged you at 2am is a re-prompt at build time.

Make it the default in OpenClaw

Two ways to wire Verificate into OpenClaw. The skill registers the validation tools so you can ask the agent to check its work; the guard plugin makes it structural — it gates every final answer through Verificate and (opt-in) inspects code-writing tool calls before they touch disk.

# register the tools
openclaw mcp add verificate --http https://mcp.verificate.ai/mcp

# or install the guard plugin for a hook on every answer
git clone https://github.com/Verificate-Dev/verificate-openclaw-guard \
  ~/.openclaw/plugins/verificate-guard

Free to try — 25 validations per machine, no signup. In a community where one skill in eight carries a critical flaw, the honest move is to verify before you trust. See all the ways to add Verificate.