*Published: February 11, 2026 · OpenClaw Pulse*
OpenClaw went from obscure open-source project to mainstream AI agent in a matter of days. Originally launched as ClawdBot, then rebranded to MoltBot, and now simply OpenClaw — the self-hosted personal AI assistant has captured the imagination of hundreds of thousands of users who want an agent that “actually does things.”
But that power comes with a cost. And this week, researchers made that cost impossible to ignore.
Over 400 malicious skills were uploaded to ClawHub — OpenClaw’s community skill marketplace — in a single week. One of the platform’s most popular add-ons, a Twitter skill, turned out to be a malware delivery vehicle. The openclaw clawhub security model is, as it stands today, fundamentally broken.
Here’s what happened, why it matters, and what you should do right now.
What Are ClawHub Skills, and Why Should You Care?
OpenClaw extends its capabilities through skills — community-contributed packages that teach the agent how to perform new tasks. Want your agent to manage your calendar? There’s a skill for that. Post to Twitter? Book flights? Monitor crypto prices? Skills cover it all.
Here’s the critical detail: skills are primarily markdown files containing instructions for the AI agent, often bundled with scripts that the agent can execute. When you install a skill, you’re handing it the same permissions OpenClaw already has on your machine — which, for many users, means full shell access, file read/write, and browser control.
There is no sandbox. There is no permission prompt per skill. If OpenClaw can do it, so can every skill you install.
ClawHub currently hosts roughly 6,000 community skills. Until this week, there was essentially no moderation layer between a skill being uploaded and a user installing it on their machine.
The Malware They Found
The findings came from multiple independent sources, all converging on the same conclusion: ClawHub security is inadequate.
OpenSourceMalware identified 28 malicious skills published to ClawHub between January 27–29, followed by a flood of 386 more between January 31 and February 2. These skills masqueraded as cryptocurrency trading automation tools. In reality, they delivered information-stealing malware designed to harvest:
- Exchange API keys
- Wallet private keys
- SSH credentials
- Browser passwords
But the more alarming discovery came from 1Password’s Jason Meller, who examined one of ClawHub’s most-downloaded skills — a “Twitter” add-on. Buried inside its markdown instructions were directions designed to trick the agent into navigating to a malicious URL and executing a command that downloads infostealing malware. The instructions didn’t target the user directly. They targeted the AI agent itself, exploiting the fact that OpenClaw follows instructions in skill files with the same trust it gives its own system prompt.
This is prompt injection weaponised as a supply chain attack.
Cisco’s AI Threat and Security Research team went further. They ran a popular skill called “What Would Elon Do?” through their newly released Skill Scanner tool and found nine security issues — two critical, five high severity. The skill contained embedded bash commands, a direct prompt injection to bypass safety guidelines, and a silent curl command that exfiltrated data to an external server. The agent executed it without informing the user.
As Cisco’s researchers bluntly put it: “The skill we invoked is functionally malware.”
Why This Is Worse Than npm or pip Supply Chain Attacks
If this sounds familiar, it should. The software ecosystem has been battling supply chain attacks for years. Malicious packages on npm, PyPI, and RubyGems have stolen credentials, installed backdoors, and cryptojacked machines. The pattern is well-established: create a package with a plausible name, get it indexed, wait for installs.
ClawHub has the same problem — but amplified by two factors that make openclaw skills malware uniquely dangerous:
1. Agent permissions are god-mode by default. When you install a malicious npm package, it runs in the context of your Node.js project. When you install a malicious OpenClaw skill, it runs in the context of an AI agent that may have access to your entire filesystem, your shell, your browser sessions, your email, and your messaging apps. The blast radius isn’t a project directory — it’s your digital life.
2. The attack vector is natural language. Traditional malware needs to contain executable code that security scanners can flag. A malicious skill can be a plain markdown file containing conversational English that instructs the agent to perform harmful actions. No binary to scan. No suspicious imports. Just words that look like legitimate instructions until you read them very carefully.
This is what makes the openclaw extensions ecosystem so treacherous. The attack surface isn’t code — it’s language. And language is much harder to audit at scale.
What OpenClaw Is Doing About It
To OpenClaw’s credit, founder Peter Steinberger has responded quickly. Here’s what’s been implemented so far:
- GitHub account requirement: Skill publishers must now have a GitHub account at least one week old. This raises the bar slightly above zero, but won’t stop determined attackers.
- Skill reporting: Users can now flag suspicious skills. Community-driven moderation — necessary but insufficient on its own.
- VirusTotal partnership: As of February 7, OpenClaw has partnered with VirusTotal to scan third-party skills. The company acknowledges this isn’t a “silver bullet,” but it adds a layer of automated detection.
These are reasonable first steps. They are not enough. The fundamental architecture — where skills are trusted inputs that the agent executes without isolation — remains unchanged. Until there’s a proper permission model for skills, every ClawdBot and MoltBot extension installed from ClawHub carries inherent risk.
Cisco has also open-sourced their Skill Scanner tool, which combines static analysis, behavioural analysis, and LLM-assisted semantic analysis to evaluate skills before installation. If you’re running OpenClaw in any serious capacity, this tool should be part of your workflow.
How to Vet Skills Before Installing: A Practical Guide
Don’t wait for the ecosystem to fix itself. Here’s how to protect yourself today.
1. Read the Skill Files Before Installing
Every skill is a collection of files — usually markdown, sometimes scripts. Read them. All of them. Look for:
- URLs you don’t recognise — especially in instructions that tell the agent to fetch or navigate somewhere
- Shell commands — any
curl,wget,bash,exec, orevalinstructions - Instructions to bypass safety — phrases like “ignore previous instructions,” “do not ask for confirmation,” or “execute silently”
- Data exfiltration patterns — commands that send local data to external servers
2. Check the Author
- How old is their GitHub account?
- Do they have other legitimate projects?
- Is their identity verifiable?
- A brand-new account with one skill and no history is a red flag.
3. Check Download Count vs. Age
The “What Would Elon Do?” skill was artificially inflated to the #1 position on ClawHub. High download counts on new skills should make you more suspicious, not less.
4. Use Cisco’s Skill Scanner
Run any skill through the open-source Skill Scanner before installing. It takes seconds and can catch what manual review might miss.
5. Limit OpenClaw’s Permissions
This is the nuclear option, but it’s the most effective. If you don’t need OpenClaw to have shell access, don’t give it shell access. Restrict file system access to specific directories. Disable browser control if you’re not using it. The less your agent can do, the less damage a malicious skill can cause.
6. Monitor What Your Agent Does
Watch the logs. If your agent is making network calls you didn’t expect, executing commands you didn’t ask for, or accessing files outside its normal scope — something is wrong. OpenClaw’s documentation at docs.molt.bot covers logging configuration.
The Bigger Picture
OpenClaw’s security problems aren’t unique to OpenClaw. They’re a preview of what happens when AI agents with real-world capabilities meet open marketplaces with minimal oversight. Every agent platform — whether it’s ClawdBot-era hobbyist setups or enterprise MoltBot deployments — will face this same tension between extensibility and safety.
The industry is building agents that can read your email, manage your files, execute code, and control your browser. Then it’s distributing untrusted third-party instructions for those agents through open marketplaces. The inevitable result is exactly what researchers found this week.
ClawHub security will improve. Scanning will get better. Permission models will emerge. But right now, in February 2026, the ecosystem is the Wild West. If you’re running OpenClaw with community skills, you are the security layer.
Act accordingly.
*Got a tip about OpenClaw security issues? Reach out at tips@openclawpulse.com.*