Malicious OpenClaw/MoltBot Skills - 230+ Supply Chain Packages — Threadlinqs Intelligence
As of 2026-05-30, Malicious OpenClaw/MoltBot Skills - 230+ Supply Chain Packages is a high-severity supply chain threat attributed to a Multiple-nexus actor, tracked by Threadlinqs Intelligence with 13 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0019 · Severity: HIGH · CVSS: 8.1 · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Multiple · FINANCIAL
Over 230 malicious OpenClaw/MoltBot skills were discovered across ClawHub (the official skills registry), GitHub repositories, and third-party sharing platforms. These skills exploited OpenClaw's
OpenClaw (formerly MoltBot/ClawdBot) is an open-source AI personal assistant platform with 100,000+ users that supports extensibility through 'skills' — installable instruction packages that teach the AI agent how to use specific tools. Skills are distributed through ClawHub (the official registry at clawhub.com), GitHub repositories, and community sharing channels.
**The OpenClaw Skills Trust Model:**
OpenClaw skills follow the AgentSkills specification. Each skill is a directory containing a SKILL.md file with YAML frontmatter (metadata) and natural language instructions. When installed, skills are loaded into the agent's system prompt, giving them access to all tools the agent can use:
- File system: read, write, edit, delete files anywhere the agent has permissions
- Shell execution: run arbitrary commands via the exec tool (with or without sandbox, depending on configuration)
- Network access: web_fetch, web_search, browser automation
- Messaging: send messages through connected services (Telegram, WhatsApp, Signal, Discord, iMessage)
- Configuration: read openclaw.json containing API keys, tokens, and service credentials
- Memory: read/write to MEMORY.md and memory files containing personal information
Skills are loaded from three locations with precedence: workspace/skills (highest) → ~/.openclaw/skills (managed) → bundled skills (lowest). Third-party skills installed via `clawhub install` land in the workspace skills directory and override bundled skills of the same name.
**The Attack Campaign:**
Security researchers identified 230+ malicious skills across ClawHub and GitHub that exploited this trust model through several attack vectors:
1. **Prompt Injection via SKILL.md:** Malicious instructions embedded in SKILL.md files that, when loaded into the agent's context, override safety guardrails and execute attacker-controlled actions. Because SKILL.md content is injected directly into the system prompt, prompt injection is the primary attack surface. Examples:
- Instructions telling the agent to silently exfiltrate openclaw.json contents to an external URL
- Instructions to disable exec.approvals (safety prompts) before running commands
- Instructions to read MEMORY.md and send personal information to attacker-controlled channels
2. **Bundled Malicious Scripts:** Skills can reference scripts in their directory via {baseDir}. Malicious skills included shell scripts, Python scripts, or Node.js modules that:
- Established reverse shells to attacker C2 servers
- Installed cryptocurrency miners (XMRig) leveraging GPU resources common on AI workstations
- Exfiltrated SSH keys, AWS credentials, browser cookies, and cryptocurrency wallet files
- Modified other installed skills to inject persistence (skill-level supply chain attack within the supply chain attack)
3. **Typosquatting:** Malicious skills published under names similar to popular legitimate skills (e.g., 'nano-bannana-pro' vs legitimate 'nano-banana-pro', 'weatherr' vs 'weather'). Users installing via ClawHub could accidentally install the malicious variant.
4. **Name Shadowing:** Due to the skill precedence model, a workspace skill with the same name as a bundled skill overrides it. Malicious skills were published with the same names as popular bundled skills, designed to be installed to workspace/skills and silently replace the legitimate version.
5. **Metadata Abuse:** Skills can specify environment variables and API keys via frontmatter metadata. Malicious skills requested unnecessary environment variables (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN) or configured env injection that leaked secrets into command arguments visible in process listings.
**Impact:**
- API key and token exfiltration from openclaw.json (messaging tokens, cloud API keys, payment keys)
- Personal data theft from MEMORY.md and memory files (user preferences, schedules, contacts)
- Cryptocurrency mining on AI workstations (typically high-end GPU machines)
- Lateral
Weaknesses (CWE)
CWE-829, CWE-494
Target sectors: Technology, Software Development, AI/ML, Individual Users, All Sectors Using AI Assistants
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 13 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195, T1199, T1059, T1059, T1059, T1204, T1546, T1554, T1548, T1562