feat: Add ClawScanner security integration #104

Nwosu-Ihueze · 2026-02-02T18:11:57Z

Summary

Adds ClawScanner security integration to scan skills for malware, dangerous code patterns, and vulnerabilities before publishing.

Changes

convex/lib/skillScan.ts: Scanner API client
convex/lib/skillScan.test.ts: Tests
convex/lib/skillScanPublish.ts: Added 4-line scan integration

How it works

When a skill is published, files are sent to ClawScanner API
Scanner checks for malware, reverse shells, data exfiltration, etc.
If blocked → publish fails with error
If flagged → publish succeeds but skill is marked for review
If clean → publish succeeds normally

Testing

All existing tests pass
New tests added for scan result handling

Working on open sourcing the scanner, you can test as a standalone here: clawscanner.xyz

Greptile Overview

Greptile Summary

This PR adds a ClawScanner integration to the skill publish flow by introducing a small scanner client (convex/lib/skillScan.ts) and invoking it during publishVersionForUser (convex/lib/skillPublish.ts) to block uploads with critical/high findings. It also updates Convex generated API typings and lockfile, and adds unit tests for scan result handling.

Confidence Score: 3/5

Generally safe to merge, but a couple of behavior mismatches may surprise users in production.
Core changes are small and localized, but there are two notable gaps: the scanner-disable branch is dead code (hard-coded URL), and flagged verdict handling is currently ignored so the moderation/mark-for-review behavior described in the PR isn’t implemented. Availability impact is also worth confirming since scan failures currently block publishing.
convex/lib/skillScan.ts, convex/lib/skillPublish.ts

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

Context used:

Context from dashboard - AGENTS.md (source)

- Add skillScan.ts for malware/vulnerability scanning - Integrate scanner into skill publish flow - Block malicious uploads before publishing - Add tests for scan result handling

vercel · 2026-02-02T18:12:01Z

@Nwosu-Ihueze is attempting to deploy a commit to the Amantus Machina Team on Vercel.

A member of the Team first needs to authorize it.

greptile-apps

_{3 files reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-02T18:13:55Z

convex/lib/skillScan.ts

+  if (!SCANNER_URL) {
+    console.warn('ClawScanner not configured, skipping security scan')
+    return {
+      verdict: 'clean',


[P1] SCANNER_URL is a non-empty constant, so the if (!SCANNER_URL) branch is dead code and the scan will never be skipped.

If the intent is to allow disabling the scanner or switching environments, this should be driven by config/env rather than a hard-coded URL; otherwise the warning/log and “disabled” ScanResult are misleading and untestable.

Prompt To Fix With AI

This is a comment left during a code review. Path: convex/lib/skillScan.ts Line: 46:49 Comment: [P1] `SCANNER_URL` is a non-empty constant, so the `if (!SCANNER_URL)` branch is dead code and the scan will never be skipped. If the intent is to allow disabling the scanner or switching environments, this should be driven by config/env rather than a hard-coded URL; otherwise the warning/log and “disabled” ScanResult are misleading and untestable. How can I resolve this? If you propose a fix, please make it concise.

"Fixed in commit 65363d7"

greptile-apps · 2026-02-02T18:13:56Z

convex/lib/skillScan.ts

+    return {
+      verdict: 'blocked',
+      findings: [
+        {
+          rule_id: 'scanner/unavailable',
+          engine: 'system',
+          severity: 'critical',
+          message: 'Security scanner unavailable - upload blocked for safety',
+        },


[P1] scanSkillFiles converts any scanner/network error into a blocked verdict (see catch block) which will hard-fail skill publishing whenever the external API is down/slow or returns malformed JSON.

If the desired behavior is “fail closed”, that’s fine, but it’s a reliability/availability trade-off worth making explicit (and maybe differentiating between transient errors vs actual blocked verdicts) since it can prevent all publishes during an outage.

Prompt To Fix With AI

This is a comment left during a code review. Path: convex/lib/skillScan.ts Line: 88:96 Comment: [P1] `scanSkillFiles` converts *any* scanner/network error into a `blocked` verdict (see catch block) which will hard-fail skill publishing whenever the external API is down/slow or returns malformed JSON. If the desired behavior is “fail closed”, that’s fine, but it’s a reliability/availability trade-off worth making explicit (and maybe differentiating between transient errors vs actual `blocked` verdicts) since it can prevent all publishes during an outage. How can I resolve this? If you propose a fix, please make it concise.

"Fixed in commit 65363d7"

greptile-apps · 2026-02-02T18:13:57Z

convex/lib/skillPublish.ts

+
+  const scanResult = await scanSkillFiles(ctx, safeFiles)
+  handleScanResult(scanResult)
+


[P2] handleScanResult(scanResult) is called but its return value (rule IDs for flagged verdicts) is ignored, so the “publish succeeds but skill is marked for review” behavior described in the PR won’t happen.

If flagged skills are meant to be marked/reviewed, the returned flags need to be persisted (e.g., stored on the version/skill or passed into insertVersion) or used to enqueue moderation.

Prompt To Fix With AI

This is a comment left during a code review. Path: convex/lib/skillPublish.ts Line: 117:120 Comment: [P2] `handleScanResult(scanResult)` is called but its return value (rule IDs for `flagged` verdicts) is ignored, so the “publish succeeds but skill is marked for review” behavior described in the PR won’t happen. If flagged skills are meant to be marked/reviewed, the returned flags need to be persisted (e.g., stored on the version/skill or passed into `insertVersion`) or used to enqueue moderation. How can I resolve this? If you propose a fix, please make it concise.

"Fixed in commit 65363d7"

greptile-apps · 2026-02-02T18:13:58Z

convex/lib/skillScan.test.ts

+describe('handleScanResult', () => {
+    it('returns empty array for clean verdict', () => {
+        const result: ScanResult = {
+            verdict: 'clean',
+            findings: [],
+            scanned_at: new Date().toISOString(),
+            duration_ms: 50,
+            files_scanned: 3,
+            scanner_version: '0.1.0',
+            summary: { critical: 0, high: 0, total: 0 },
+        }
+        const flags = handleScanResult(result)
+        expect(flags).toEqual([])


[P3] This test file uses 4-space indentation and double quotes are avoided elsewhere, but the repo style guide (AGENTS.md) specifies 2-space indentation + single quotes (Biome). Running formatting/lint in CI may fail or will produce noisy diffs.

Consider running the formatter on this file to match project conventions.

Prompt To Fix With AI

This is a comment left during a code review. Path: convex/lib/skillScan.test.ts Line: 4:16 Comment: [P3] This test file uses 4-space indentation and double quotes are avoided elsewhere, but the repo style guide (AGENTS.md) specifies 2-space indentation + single quotes (Biome). Running formatting/lint in CI may fail or will produce noisy diffs. Consider running the formatter on this file to match project conventions. How can I resolve this? If you propose a fix, please make it concise.

"Fixed in commit 65363d7"

convex/lib/skillScan.ts

- Remove dead if-branch for scanner URL check - Add explicit comment explaining fail-closed is intentional - Capture and log flagged skills for moderation visibility - Fix test file formatting (2-space indent) - Validate files added before scanning (Vercel review)

feat: Add ClawScanner security integration

374e887

- Add skillScan.ts for malware/vulnerability scanning - Integrate scanner into skill publish flow - Block malicious uploads before publishing - Add tests for scan result handling

greptile-apps bot reviewed Feb 2, 2026

View reviewed changes

vercel bot reviewed Feb 2, 2026

View reviewed changes

convex/lib/skillScan.ts Show resolved Hide resolved

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add ClawScanner security integration #104

feat: Add ClawScanner security integration #104

Nwosu-Ihueze commented Feb 2, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

vercel bot commented Feb 2, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 2, 2026

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Uh oh!

greptile-apps bot Feb 2, 2026

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Uh oh!

greptile-apps bot Feb 2, 2026

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Uh oh!

greptile-apps bot Feb 2, 2026

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant


		const scanResult = await scanSkillFiles(ctx, safeFiles)
		handleScanResult(scanResult)

Uh oh!

feat: Add ClawScanner security integration #104

Are you sure you want to change the base?

feat: Add ClawScanner security integration #104

Conversation

Nwosu-Ihueze commented Feb 2, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

How it works

Testing

Greptile Overview

Greptile Summary

Confidence Score: 3/5

Uh oh!

vercel bot commented Feb 2, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Nwosu-Ihueze Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Nwosu-Ihueze commented Feb 2, 2026 •

edited by greptile-apps bot

Loading