AgentsOpenClaw + VirusTotal: Agent Skill Marketplace Gets Malware ScanningThe Hacker News·high signalXBlueskyLinkedInCopy linkOpenClaw partnered with Google VirusTotal to scan ClawHub skills. Already flagged 314 skills from single malicious user as malware droppers.SourceSource pageThe Hacker News↳ Follow the threadShared entity / Stack layerVetClaw Separates Agent Interaction From Workflow Orchestration by Pairing OpenClaw With LangGraph on an Edge DevicearXiv 2607.26042Shared entity / Actor rolecodebase-memory-mcp Backs Its Code-Intelligence Claims With 6,768 Passing Tests, SLSA 3 Provenance and an OpenSSF ScorecardGitHubShared entity / Policy dependencyPrefactor Tops Product Hunt on July 28 With 591 Points for Real-Time Agent Evaluation That Can Pause a Running AgentProduct HuntStack layer / Threat patternAddy Osmani's agent-skills Hits 80,712 Stars With Just 24 Skills — Encoding Hyrum's Law and the Beyoncé Rule Into Agent WorkflowsGitHubStack layer / Threat patternSkillGate Screens Agent Skill Files Before Install: F1=0.817 at 1.13% FPR While Cutting LLM Input Tokens 77%arXiv 2607.25619Stack layer / Threat patternOpenAI Open-Sources Codex Security to 3.7K Stars — and HN Immediately Reports Scans Burning Half a Week's Token QuotaGitHub / Hacker NewsPolicy dependency / Threat patternGitHub gives Dependabot a three-day default cooldown to outlast poisoned-package windowsThe Hacker NewsStack layer / ContrastTreat agent skills as software artifacts: single responsibility, interface/implementation separation, and a decision test for skill vs hook vs subagentarXiv 2607.25032