OpenClaw Adds Tencent AIG to Every ClawHub Security Review.

Tencent AIG now reviews every skill and plugin uploaded to OpenClaw’s ClawHub. It runs inside ClawScan alongside NVIDIA’s SkillSpector, with an AI judge making the final security assessment.

The change adds a second independent view of each upload. ClawScan is the open-source command-line tool behind ClawHub’s security reviews. According to the OpenClaw blog post, both scanners inspect the files separately before the judge considers their findings and the uploaded code.

Tencent describes AIG, short for AI-Infra-Guard, as an LLM-driven, multi-stage pipeline for code audits and vulnerability reviews. It examines the relationship between a skill’s instructions and its scripts, dependencies and data flows.

The scanner covers nine risk categories. These include instruction hijacking, memory poisoning, remote payload execution, malicious code, unauthorised access, persistence and insecure dependencies.

AIG and SkillSpector can reach different conclusions about the same upload. ClawScan preserves both sets of findings rather than combining them into one scanner result. Its AI judge then reviews that evidence with the original files.

OpenClaw and Tencent tested the combined system against 556 cases from SkillTrustBench. The public benchmark was developed by Tencent and the Chinese University of Hong Kong, Shenzhen. It contains benign, suspicious and malicious skills across nine risk categories.

Benchmark cases

556

fixed subset of SkillTrustBench

Labels matched

86.9%

across the benchmark subset

Malicious cases classified correctly

98.6%

in the same evaluation

Contributors can use the benchmark to compare different scanners, AI models and review instructions. This provides a fixed set of cases for checking whether a proposed change improves classification.

Tencent and OpenClaw will also share anonymised cases where their scanners disagree. Those cases feed an ongoing review loop intended to improve both scanning systems.

What is Tencent AIG in OpenClaw?

Tencent AIG is an LLM-driven scanner for code audits and vulnerability reviews. It is now part of ClawScan, which checks every skill and plugin uploaded to ClawHub.

How does Tencent AIG work with SkillSpector?

AIG and NVIDIA’s SkillSpector scan each upload independently. An AI judge reviews both sets of findings alongside the uploaded files and makes the final security assessment.

When is Tencent AIG available for ClawHub uploads?

Tencent AIG is now included in ClawHub’s security review process. Every uploaded skill and plugin runs through it as part of ClawScan.