Offline SBOM Verifier for OpenClaw Detects Poisoned Skills in Under 0.2 Seconds
Offline SBOM Verification for OpenClaw Skills
A developer has created an offline SBOM (Software Bill of Materials) verifier for OpenClaw skills after discovering a poisoned skill that was quietly exfiltrating SSH keys. The tool verifies SBOM integrity without requiring API calls or internet connectivity, using pure Rust implementation.
Key Details from the Source
The developer caught a poisoned OpenClaw skill last week that was exfiltrating SSH keys. In response, they built a tool that performs SBOM verification offline. The verification process completes in under 0.2 seconds according to the source title.
The source includes a code snippet showing how the tool identifies poisoned skills:
POISONED
Expected: 2cf24dba...
Actual: a1b2c3d4...This demonstrates the tool comparing expected hash values against actual hash values to detect tampering. The developer is planning pro features including CI hooks and auto-fixes for future versions.
Technical Context
SBOM verification is a security practice that ensures software components haven't been tampered with by comparing cryptographic hashes of files against known good values. OpenClaw skills are modular components that extend the AI coding agent's capabilities, making them potential attack vectors if compromised. Offline verification eliminates dependency on external services and reduces attack surface.
Rust was chosen for its memory safety guarantees and performance characteristics, which are particularly valuable for security-critical tools. The sub-0.2 second verification time mentioned in the title suggests the tool uses efficient hashing algorithms and minimal overhead.
For developers using OpenClaw, this tool addresses a specific security concern: verifying that downloaded skills haven't been modified to include malicious code. The planned CI hooks would integrate this verification into continuous integration pipelines, while auto-fixes might automatically remediate detected issues.
📖 Read the full source: r/openclaw
👀 See Also
Claude Code --dangerously-skip-permissions vulnerability and open-source defense tool
Lasso Security published research showing indirect prompt injection vulnerabilities in Claude Code when using --dangerously-skip-permissions flag, with attack vectors including poisoned README files, malicious web content, and MCP server outputs. They released an open-source PostToolUse hook that scans tool outputs against 50+ detection patterns.
SupraWall MCP Plugin Blocks Prompt Injection Attacks on Local AI Agents
SupraWall is an MCP plugin that intercepts and blocks sensitive data exfiltration attempts from AI agents, demonstrated in a red-team challenge where it prevented credential leaks via prompt injection attacks.
Audio-Layer Prompt Injection Against Claude: What's Not in the Transcript
A builder of a prompt injection detection API shares findings on audio-layer attacks against Claude, revealing that attacks in the signal (not transcript) are invisible in logs and pose a real threat to voice agents.
Tool Authority Injection in LLM Agents: When Tool Output Overrides System Intent
A researcher demonstrates 'Tool Authority Injection' in a local LLM agent lab, showing how trusted tool output can be elevated to policy-level authority, silently changing agent behavior while sandbox and file access remain secure.