Update Gateway API, ClawHub, WebClaw, and troubleshooting docs from June-July 2026 research

- Gateway API: document wire protocol v4 with the July 6 N-1 node/probe
  compatibility window, the v2026.6.11 plugin method dispatch fix, and the
  v2026.7.1 beta 'openclaw attach' command
- ClawHub: NVIDIA SkillSpector scanning (June 1 partnership), staged
  publishing with prepublication checks, Unit 42's June 23 disclosure of
  five skills that evaded scanning, 14-day account-age publish gate, and
  the 4-report auto-hide moderation threshold
- Known vulnerabilities: Unit 42 and SkillSpector timeline entries, ClawHub
  client DoS hardening in v2026.6.11 (PR #95226)
- Troubleshooting/FAQ: note the reported v2026.6.11 empty-tool-output
  regression (upstream issue #98528), unacknowledged in release notes
- WebClaw: mark development as stalled (no activity since March 17, 2026)
  and point to PinchChat as the maintained alternative

All claims verified against primary sources (docs.openclaw.ai, GitHub
releases/PRs, Unit 42, official OpenClaw blog) as of 2026-07-08.

Author: melvincarvalho

docs/guides/clawhub.md

@@ -323,15 +323,16 @@ openclaw clawhub publish ./my-skill/SKILL.md --update
 - Name must be unique on ClawHub (slug format: `^[a-z0-9][a-z0-9-]*$`)
 - Must pass automated security scanning (VirusTotal + code analysis)
 - Must include at least one usage example in the Markdown body
-- GitHub account must be at least one week old
+- GitHub account must be at least **14 days old** (raised from one week; confirmed by the project creator)
 - Bundle under 50 MB, text-only files
 
 ### What Happens After Publishing
 
 1. **Validation** — Token, metadata, name, version, and files are checked
-2. **Security scan** — VirusTotal + code pattern analysis runs automatically
-3. **Hold period** — New releases may be held from install surfaces until review completes
-4. **Available** — Once cleared, the skill appears in search and can be installed
+2. **Staged publish** (July 2026+) — Publishes are held behind a prepublication worker and scanned before finalization
+3. **Security scan** — VirusTotal + code pattern analysis + ClawScan runs automatically
+4. **Hold period** — New releases may be held from install surfaces until review completes; scan-held/blocked releases stay visible to their owners but are hidden from public catalogs
+5. **Available** — Once cleared, the skill appears in search and can be installed
 
 If validation fails, nothing is published and you get an error explaining why.
 
@@ -382,6 +383,17 @@ The malicious skills deployed multiple attack types:
 
 100% of confirmed malicious skills contained malicious code, while 91% also employed prompt injection techniques.
 
+### Unit 42 Findings (June 2026)
+
+On June 23, 2026, Palo Alto Networks' Unit 42 published research identifying **five malicious skills that evaded ClawHub's scanning** during their February–May 2026 analysis:
+
+- **Two macOS infostealers** with command-and-control connectivity (linked to cluw and Atomic macOS Stealer)
+- **`omnicogg`** — a scanner-evasion skill using 22 MB of file padding to exceed content-analysis size limits
+- **`money-radar`** — runtime affiliate-link injection
+- **`letssendit`** — an agentic Solana front-running skill
+
+OpenClaw banned the publisher accounts and deleted all five skills. The takeaway: scanning keeps improving (see below), but evasion keeps pace — always review skill source before installing.
+
 ### Broader Quality Issues
 
 Snyk's ToxicSkills audit found problems beyond just intentionally malicious skills:
@@ -393,9 +405,13 @@ Snyk's ToxicSkills audit found problems beyond just intentionally malicious skil
 
 **Automated scanning:**
 - **VirusTotal integration** (v2026.2.6+) — All skills scanned on upload, periodic re-scanning
+- **NVIDIA SkillSpector** (June 1, 2026 partnership) — Static checks plus AI-assisted semantic analysis in the ClawScan pipeline, producing Clean/Suspicious/Malicious verdicts, along with Skill Cards for provenance
+- **Staged publishing** (July 2026+) — Publishes held behind prepublication checks before finalization
 - **Code pattern analysis** — Checks declared frontmatter vs actual behavior, flags mismatches
 - **Metadata validation** — Detects undeclared environment variables and binary dependencies
 
+**Moderation:** Signed-in users can report skills; a skill is auto-hidden after **4 unique abuse reports**, and moderators can hide, restore, or ban.
+
 **Community tools:**
 - **[Clawdex](https://koisecurity.com/clawdex)** (7.1k downloads) — Pre-installation scanning against Koi's malicious skills database
 - **[SkillGuard](https://github.com/bossondehiggs/skillguard)** — Skill file vulnerability scanner

docs/guides/webclaw.md

@@ -10,7 +10,7 @@ keywords: [openclaw, webclaw, web client, browser frontend, web ui, react fronte
 [WebClaw](https://github.com/ibelick/webclaw) is a community-built, browser-based chat interface for OpenClaw. It connects to your Gateway over WebSockets and provides a clean, modern UI for interacting with your agent from any device with a browser.
 
 :::info
-WebClaw is currently in **beta** (637 stars, 5 contributors). It is a third-party project and not maintained by the OpenClaw team. The repository was last updated March 17, 2026.
+WebClaw is currently in **beta** (~639 stars, 5 contributors). It is a third-party project and not maintained by the OpenClaw team. As of July 2026 it has had no commits, tags, or releases since March 17, 2026 — development appears stalled (the npm package remains at v0.1.1 from February 2026). Consider [PinchChat](#pinchchat-alternative-frontend) if you need an actively maintained frontend.
 :::
 
 ---

docs/reference/faq.md

@@ -41,6 +41,8 @@ Moltbook is a separate social network (created by Matt Schlicht) where AI agents
 
 As of early July 2026, the latest stable release is **v2026.6.11** (published June 30, 2026), with **v2026.7.1** available as beta pre-releases. OpenClaw uses calendar versioning: `vYYYY.M.PATCH`, where the patch number is a sequential release counter within the month — not a calendar day.
 
+Note: some users report a regression in v2026.6.11 where [tools return empty output after the first call in a turn](/reference/troubleshooting#empty-tool-output-after-first-call-v2026611) (upstream issue #98528).
+
 ---
 
 ## Security

docs/reference/gateway-api.md

@@ -198,6 +198,15 @@ const ws = new WebSocket('ws://localhost:18789?token=your-auth-token');
 **The lack of default authentication was the root cause of CVE-2026-25253.** Enable auth if multiple users share the machine.
 :::
 
+## Protocol Versioning
+
+The Gateway wire protocol is currently **version 4** (`PROTOCOL_VERSION: 4`), and general clients, operators, and UI connections must speak v4 (`MIN_CLIENT_PROTOCOL_VERSION: 4`). Since July 6, 2026 (PR #101109), there is an N-1 compatibility window for infrastructure connections: **nodes and probes at protocol v3 remain manageable** during rolling upgrades (`MIN_NODE_PROTOCOL_VERSION: 3`).
+
+Recent Gateway-facing changes:
+
+- **v2026.6.11** — plugin-registered Gateway methods now resolve through the live registry, so they work via `openclaw gateway call` instead of failing with `unknown method` (PR #94154)
+- **v2026.7.1 (beta)** — new `openclaw attach` command launches an external harness against an existing Gateway session, for resuming and inspecting interactive Codex-style workflows (#96454)
+
 ## See Also
 
 - [The Gateway](/architecture/gateway) — Architecture details

docs/reference/troubleshooting.md

@@ -898,6 +898,10 @@ echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf
 
 ## Post-Upgrade Issues
 
+### Empty Tool Output After First Call (v2026.6.11)
+
+Users report that on **v2026.6.11**, tools (`exec`, `web_fetch`, `web_search`) can return empty output after the first call in a turn. This is tracked upstream as [issue #98528](https://github.com/openclaw/openclaw/issues/98528) but is not acknowledged in the release notes, and the v2026.7.1 betas do not explicitly claim a fix. If you hit this, check the issue for current status — workarounds are staying on v2026.6.10 or trying the v2026.7.1 beta.
+
 ### Config Wiped After Upgrade
 
 **Known issue in some v2026.5.x releases.** Always backup before upgrading:

docs/security/known-vulnerabilities.md

@@ -87,10 +87,11 @@ The full batch covers MCP loopback privilege exposure, plugin-install persistenc
 
 ### v2026.6.11 Security Hardening
 
-The v2026.6.11 release (June 30, 2026) added two further security fixes:
+The v2026.6.11 release (June 30, 2026) added further security fixes:
 
 - **Control UI DOMPurify update** ([GHSA-cmwh-pvxp-8882](https://github.com/advisories/GHSA-cmwh-pvxp-8882)) — the bundled sanitizer was updated to a patched DOMPurify release, mitigating `ALLOWED_ATTR` pollution via `setConfig()` (PR #95691)
 - **Lookalike package-source rejection** — trusted OpenClaw package sources now reject lookalike sibling paths (e.g., trusting `/artifactory/openclaw` no longer admits `/artifactory/openclaw-malicious`)
+- **ClawHub client DoS hardening** — oversized or stalled marketplace responses during skill discovery and install checks are now terminated before exhausting memory (PR #95226)
 
 ### Mitigation
 
@@ -261,7 +262,7 @@ ClawHub was **open by default** — the only requirement to publish was a GitHub
 
 1. **VirusTotal integration** (v2026.2.6+) — SHA-256 hashing checked on upload, Code Insight (Gemini-powered) analyzes full packages
 2. **Daily re-scanning** — Active skills re-scanned to detect skills that become malicious after initial upload
-3. **Community reporting** — Skills with 3+ unique reports are auto-hidden
+3. **Community reporting** — Skills are auto-hidden after 4 unique abuse reports (originally 3)
 4. **Built-in code safety scanner** — Static analysis for suspicious patterns
 5. **Verdicts system** — Benign (auto-approved), Suspicious (warning shown), Malicious (immediately blocked)
 
@@ -406,7 +407,9 @@ When these findings were reported to creator Peter Steinberger, his response was
 | Feb 9 | Follow-up: 135,000+ exposed instances, 42,665 on Shodan | **Critical** |
 | Feb 9 | JFrog: 93.4% of exposed instances have auth bypass | **Critical** |
 | Feb 9 | Gartner: "Unacceptable cybersecurity risk" published | — |
+| Jun 1 | NVIDIA SkillSpector partnership — AI-assisted skill screening added to ClawScan | Mitigation |
 | Jun 12 | v2026.6.6 released — security-hardening release (140+ PRs) | Mitigation |
+| Jun 23 | Unit 42: five malicious skills evaded ClawHub scanning (infostealers, scanner evasion via 22 MB padding, Solana front-running); all removed | **High** |
 | Jun 30 | ~45 security advisories batch-published (MCP loopback, plugin-install bypasses, model-override auth) — most patched in v2026.6.6–v2026.6.8 | **High** |
 | Jun 30 | v2026.6.11 released — DOMPurify fix (GHSA-cmwh-pvxp-8882), lookalike package-source rejection | Mitigation |