OpenClaw v2026.4.12 Introduces Cryptographically Signed Skill Manifests With eBPF Enforcement

OpenClaw v2026.4.12 adds cryptographically signed skill manifests and enforces them at the kernel level with eBPF, closing off the kind of plugin abuse that surfaced in the malicious skills vulnerability earlier in April. The update means a skill can only reach the filesystem paths and network endpoints it explicitly declares, instead of inheriting broad access once it is loaded into an agent.

OpenClaw is an open source AI agent framework used to run tool-using agents and third-party skills. In practice, that makes security boundaries especially important, because these skills often need access to files, APIs, databases, and internal services to do useful work. If a plugin can quietly reach beyond its intended scope, it can become a path for data theft, privilege abuse, or lateral movement inside a system.

The new manifest system changes how skills are trusted before they run. A manifest is a declaration that describes what a plugin is allowed to do, and in this release those manifests must be signed cryptographically. That signature gives the platform a way to verify that the manifest has not been altered and that it came from an authorized source.

The enforcement side matters as much as the signing. By using eBPF, short for extended Berkeley Packet Filter, OpenClaw can apply policy inside the Linux kernel rather than relying only on application-level checks. That makes it much harder for a skill to bypass restrictions once the agent runtime has accepted it, because the kernel is watching the actual system calls and network activity.

This is a familiar pattern in security engineering: define the allowed behavior up front, then block anything outside that boundary. The difference here is that the boundary is tied to the skill manifest and enforced close to the operating system, which gives OpenClaw a tighter control point than simple configuration flags or per-app sandboxing alone.

The timing is also telling. The company moved after the malicious skills issue earlier in April exposed how dangerous overly permissive agent plugins can be. AI agent frameworks tend to encourage modularity, with small skills pulled in from internal teams or public sources, but that modularity becomes a liability when the runtime cannot prove what a skill is allowed to touch.

Signed manifests are meant to make that trust relationship explicit. Instead of assuming a plugin behaves because it was installed from a known repository or bundled with a prompt flow, OpenClaw now checks whether the skill was approved for the resources it requests, then enforces those boundaries at runtime.

For operators, that changes the security model around third-party automation. A skill that once could read broadly across the filesystem or reach arbitrary network targets now has to declare those capabilities in advance, and the platform can deny requests that do not match the signed policy.

OpenClaw’s approach also reflects where AI agent tooling is heading more generally. As these systems take on more operational work, the security expectation moves from “Can this plugin run?” to “Exactly what can it touch, and can the platform prove it stayed inside those limits?” The v2026.4.12 release answers that question by binding skill permissions to signed manifests and enforcing them with kernel-level controls.