We just submitted our second security PR to OpenClaw — skill scanner improvements

Hey all — we're the team behind Sammā Suit, an open-source security wrapper for AI agents. Quick update on our upstream contributions:

PR #1 (already submitted): WebSocket origin validation fix — closes the vector from CVE-2026-25253.

PR #2 (just submitted): Skill scanner improvements — adds detection for dynamic import() calls, prototype pollution via proto, and encoded payload execution (base64 → eval chains). These are patterns we keep seeing in malicious skills that the current scanner misses.

Both PRs include tests and follow the existing codebase conventions. Not trying to replace anything — just making the ecosystem safer.

If you want enforcement-by-default on top of OpenClaw (budget limits, kill switches, audit trails, skill vetting), check out our plugin: openclaw plugins install samma-suit

Site: https://sammasuit.com GitHub: https://github.com/OneZeroEight-ai/samma-suit