OpenClaw (formerly MoltBot/ClawdBot) is an open-source AI personal assistant platform with 100,000+ users that supports extensibility through 'skills' — installable instruction packages that teach the AI agent how to use specific tools. Skills are distributed through ClawHub (the official registry at clawhub.com), GitHub repositories, and community sharing channels.

**The OpenClaw Skills Trust Model:**

OpenClaw skills follow the AgentSkills specification. Each skill is a directory containing a SKILL.md file with YAML frontmatter (metadata) and natural language instructions. When installed, skills are loaded into the agent's system prompt, giving them access to all tools the agent can use:

- File system: read, write, edit, delete files anywhere the agent has permissions - Shell execution: run arbitrary commands via the exec tool (with or without sandbox, depending on configuration) - Network access: web_fetch, web_search, browser automation - Messaging: send messages through connected services (Telegram, WhatsApp, Signal, Discord, iMessage) - Configuration: read openclaw.json containing API keys, tokens, and service credentials - Memory: read/write to MEMORY.md and memory files containing personal information

Skills are loaded from three locations with precedence: workspace/skills (highest) → ~/.openclaw/skills (managed) → bundled skills (lowest). Third-party skills installed via `clawhub install` land in the workspace skills directory and override bundled skills of the same name.

**The Attack Campaign:**

Security researchers identified 230+ malicious skills across ClawHub and GitHub that exploited this trust model through several attack vectors:

1. **Prompt Injection via SKILL.md:** Malicious instructions embedded in SKILL.md files that, when loaded into the agent's context, override safety guardrails and execute attacker-controlled actions. Because SKILL.md content is injected directly into the system prompt, prompt injection is the primary attack surface. Examples: - Instructions telling the agent to silently exfiltrate openclaw.json contents to an external URL - Instructions to disable exec.approvals (safety prompts) before running commands - Instructions to read MEMORY.md and send personal information to attacker-controlled channels

2. **Bundled Malicious Scripts:** Skills can reference scripts in their directory via {baseDir}. Malicious skills included shell scripts, Python scripts, or Node.js modules that: - Established reverse shells to attacker C2 servers - Installed cryptocurrency miners (XMRig) leveraging GPU resources common on AI workstations - Exfiltrated SSH keys, AWS credentials, browser cookies, and cryptocurrency wallet files - Modified other installed skills to inject persistence (skill-level supply chain attack within the supply chain attack)

3. **Typosquatting:** Malicious skills published under names similar to popular legitimate skills (e.g., 'nano-bannana-pro' vs legitimate 'nano-banana-pro', 'weatherr' vs 'weather'). Users installing via ClawHub could accidentally install the malicious variant.

4. **Name Shadowing:** Due to the skill precedence model, a workspace skill with the same name as a bundled skill overrides it. Malicious skills were published with the same names as popular bundled skills, designed to be installed to workspace/skills and silently replace the legitimate version.

5. **Metadata Abuse:** Skills can specify environment variables and API keys via frontmatter metadata. Malicious skills requested unnecessary environment variables (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN) or configured env injection that leaked secrets into command arguments visible in process listings.

**Impact:**

- API key and token exfiltration from openclaw.json (messaging tokens, cloud API keys, payment keys) - Personal data theft from MEMORY.md and memory files (user preferences, schedules, contacts) - Cryptocurrency mining on AI workstations (typically high-end GPU machines) - Lateral movement through connected messaging services (sending phishing messages via victim's connected WhatsApp/Telegram/Signal) - Persistent backdoor access via modified agent workspace files - SSH key and credential theft from the host system

**Comparison to Traditional Supply Chain Attacks:**

Malicious OpenClaw skills are analogous to malicious npm/PyPI packages but with amplified impact: - npm packages execute code with the developer's permissions during install/build - OpenClaw skills execute instructions through an AI agent with system-level access, messaging integration, and persistent memory - The AI agent's broad capability set means a single malicious skill can simultaneously exfiltrate data, send messages, modify files, and execute commands — all through natural language instructions that bypass traditional code analysis tools

**Mitigation Response:**

ClawHub implemented enhanced review processes, skill signing, and reputation scoring. OpenClaw documentation now warns: 'Treat third-party skills as untrusted code. Read them before enabling.' Sandboxing support was improved to restrict skill script execution to Docker containers.