Malicious OpenClaw Skills: How They Steal Your Keys, and What to Look For Before You Install One

Q: Does Is My Agent Safe's free check find malicious skills?

No. Our free check reads a pasted `openclaw security audit --deep` output and `openclaw --version`. It covers risky settings, such as API keys handed to skills, your version against published advisories, and exposure-related settings. It does not review skill code and does not detect malicious skills. Use ClawHub's audit page and a skill scanner for that.

Published 2026-10-19 · Updated 2026-10-19 · By The Is My Agent Safe team

Short answer

A skill is code and instructions your agent follows, so a malicious one can steal keys and passwords. In early 2026, researchers found hundreds on ClawHub, mostly asking you to install a fake prerequisite. Before you install, read the skill's ClawHub audit, check the publisher and name, refuse outside downloads, and scan it with a free skill scanner.

Koi Security audited all 2,857 ClawHub skills in February 2026 and found 341 malicious ones, 335 from one campaign it called ClawHavoc.
The common trick was a "Prerequisites" section telling you, or your agent, to download and run something else.
Download counts and rankings can be gamed, so popularity alone isn't a trust signal.
If you ran a fake prerequisite, treat the whole machine as compromised, and change your keys and passwords from a different, clean device.

A skill is a folder your agent learns from. ClawHub's docs describe it as a versioned bundle centered on a SKILL.md file, which can also include scripts. Your agent reads the instructions and may run the scripts. That's what makes skills useful, and it's why OpenClaw's skills docs say to treat third-party skills as untrusted code and read them before enabling.

This guide explains how malicious skills have worked so far, the red flags that showed up again and again, and what to check before and after you install one.

How malicious skills have stolen keys and passwords

ClawHavoc: the fake prerequisite

On February 1, 2026, Koi Security reported that it had audited all 2,857 skills on ClawHub and found 341 malicious ones. 335 of them came from one campaign it named ClawHavoc. We cite Koi Security's report from an archived copy (March 2026): Koi is now part of Palo Alto Networks, and the original page now redirects to Palo Alto Networks' site.

The trick was simple. The skill looked professional, but its documentation had a "Prerequisites" section saying you needed to install a utility first:

On Windows, it linked to a password-protected ZIP. Koi says the password was there to stop antivirus tools from looking inside.
On macOS, it pointed to a script to paste into Terminal. The script decoded a hidden command that downloaded more code. Koi identified the final payload as Atomic Stealer (AMOS), malware that takes keychain passwords, browser data, crypto wallets and files.

The skills posed as popular tools: crypto wallet trackers, trading bots, YouTube utilities, auto-updaters, Google Workspace connectors, and lookalikes of ClawHub's own name. On February 16, 2026, Koi updated its count to 824 malicious skills out of more than 10,700, including fake security-scanning skills.

Other methods in the same report

A backdoor hidden in working code. Two skills appeared to work as described, but Koi found a line about 180 lines in that opened a remote shell to the attacker when you used the skill normally.
Reading the agent's own keys. One skill posing as a weather tool read the agent's .env file and sent its contents to an outside web address.

Using the agent as the go-between

Trend Micro reported on February 23, 2026 that 39 skills put the fake-install instructions in SKILL.md itself, so the agent presented them to the user as a setup step. Depending on the model, the agent either refused, installed it silently or kept asking the user to install a "driver". Trend Micro said copies also appeared on other skill sites. The malware then showed a fake password dialog.

Faked popularity

Silverfort reported on March 24, 2026 that a ClawHub flaw let anyone inflate a skill's download count. Its test skill, with a deliberately low-impact payload that only reported the user and machine name, reached the top of its category and ran about 3,900 times in 6 days. When Silverfort asked its own OpenClaw agent to pick an email and calendar skill, the agent chose the test skill because it had the highest score. ClawHub fixed the flaw within a day of the report.

Six red flags before you install a skill

It asks you, or your agent, to download and run something else first, especially a password-protected archive or a command to paste into Terminal. This was the main ClawHavoc pattern.
It contains encoded or hidden commands, such as a long base64 string piped into a shell. ClawHub's publisher guidance tells authors to avoid obfuscated install commands.
Its name is a near-copy of a well-known tool, or of ClawHub itself. Koi found 29 ClawHub lookalike names.
It asks for more than its job needs. ClawHub's audit checks whether a skill's declared environment variables, permissions and files match what it says it does. A summarizer that wants your wallet or provider keys doesn't match.
Popularity is the only reason to trust it. Download counts and rankings can be gamed.
It's in a bait category: crypto tools, trading bots, auto-updaters, "lost" crypto finders or security tools. These were among the disguises in Koi's report. Take extra care when you can't trace the publisher.

What to check before you install

Read the ClawHub audit page. ClawHub's skill pages link to a full audit at /<owner>/skills/<slug>/security-audit. Don't install anything marked Malicious, and read the findings on anything marked Review or Warn. ClawHub's docs say a Pass is reassuring but does not replace your own judgment.
Check the publisher, source and history: owner, linked source code, version, changelog. ClawHub's docs list these as the trust signals to review.
Run openclaw skills verify @owner/<slug> to ask ClawHub for the skill's verification record. Per OpenClaw's skills CLI docs, installs from skills.sh are shown as "Not scanned by ClawHub", and Git or local installs are unmanaged copies, not ClawHub listings.
Read SKILL.md yourself. Look for the red flags above, especially install steps that point outside the skill.
Get a second opinion from a free scanner, such as Cisco's skill-scanner, NVIDIA SkillSpector or Ironheights. Install the scanner from its official repository, since fake security skills are themselves a known lure. Cisco and Ironheights both say a clean result means their rules or known patterns didn't match, not that the skill has no problems, and SkillSpector lists what it can't analyze.
Pin a version with openclaw skills install @owner/<slug> --version <version>, so a later update doesn't arrive unreviewed.
Limit who sees it. OpenClaw's skills docs describe agent allowlists that restrict which skills each agent sees, and security.installPolicy, a local policy command that runs before installs continue.

After you install: what the built-in audit can and can't see

OpenClaw's tool permissions docs say to treat skill folders as trusted code and restrict who can change them. Run openclaw security audit --deep after installing. Per the audit checks catalog, --deep adds a skills.code_safety scan for suspicious patterns in skill installer metadata and code. That scan has file limits, and a scan_truncated warning means some files weren't checked. A clean scan is a good sign, not proof.

Our audit explainer covers what each finding means, and the 12-point checklist covers the rest of your setup.

If you think you installed a bad skill

Stop the agent. OpenClaw's incident steps start with stopping the Gateway and closing exposure.
Remove the skill. For a ClawHub-tracked skill, OpenClaw's docs give clawhub uninstall @owner/<slug>.
If you ran a "prerequisite" installer or pasted a command into Terminal, treat the whole machine as compromised, not just the agent. The stealers Koi and Trend Micro analyzed took passwords, keychains, browser data and files. Don't sign in to anything from that machine until it has been rebuilt.
Rotate keys and tokens from a different, clean device: Gateway auth, remote client secrets, channel tokens and model provider keys, plus your passwords if step 3 applies. A key you replace on an infected machine can be stolen again. Our guide to leaked AI agent API keys walks through the first hour.
Review logs with openclaw logs, then re-run openclaw security audit --deep.
Report the listing with the Report skill button on its ClawHub page.

What our free check covers (and what it doesn't)

Our free check doesn't look inside skills. It reads a pasted openclaw security audit --deep output and openclaw --version, and covers your settings, your version and your exposure:

risky settings, such as API keys handed to skills;
your version, checked against published security advisories;
exposure and access findings from OpenClaw's own audit, explained in plain English.

It does not review skill or MCP server code, scan ClawHub listings or detect malicious skills. If your pasted output includes OpenClaw's own skill code-scan findings (skills.code_safety), we explain them, but a skill that OpenClaw's scan didn't flag won't show up in our result. Green means no issues found in the checks we ran. See Limits of the check.

Terms such as ClawHub and supply-chain attack are in the glossary.

Frequently asked questions

Are ClawHub skills checked for malware?

Yes, with limits. ClawHub's docs say it audits each release uploaded to it and shows a status of Pass, Review, Warn, Malicious, Pending or Error. The audit combines NVIDIA's SkillSpector, Tencent Zhuque Lab's A.I.G scanner and ClawHub's own risk analysis. ClawHub says audits are strong signals but not a guarantee, and a Pass doesn't replace your own judgment.

How many skills are malicious?

We found no current public count. Koi Security found 341 malicious skills out of 2,857 on ClawHub on February 1, 2026, and updated that to 824 out of more than 10,700 on February 16, 2026. Trend Micro separately reported 39 related skills and said copies also appeared on other skill sites. These figures are from early 2026.

Can a top-ranked skill be malicious?

It has happened in testing. Silverfort reported in March 2026 that a ClawHub flaw let anyone inflate a skill's download count. Its low-impact test skill reached the top of its category and ran about 3,900 times in 6 days. ClawHub fixed the flaw within a day of disclosure, but the lesson stands: rankings and download counts are not proof of good behavior.

What access should a skill ask for?

Only what its job needs. ClawHub's audit asks whether a skill's name, summary, declared environment variables, permissions and files line up with what it says it does. A weather skill that wants your crypto wallet or your provider keys doesn't line up. Neither does a skill that asks you to run a separate installer.

What if I already installed a bad skill?

Stop the agent, remove the skill, and follow OpenClaw's incident steps: contain, rotate keys and tokens, then review logs. If you ran a prerequisite installer or pasted a command into Terminal, treat the machine as compromised and rotate keys and passwords from a different, clean device, because the stealers researchers found took passwords, browser data and files, not just agent keys. Report the listing on ClawHub.

Does Is My Agent Safe's free check find malicious skills?

No. Our free check reads a pasted openclaw security audit --deep output and openclaw --version. It covers risky settings, such as API keys handed to skills, your version against published advisories, and exposure-related settings. It does not review skill code and does not detect malicious skills. Use ClawHub's audit page and a skill scanner for that.