# Malicious OpenClaw/MoltBot Skills - 230+ Supply Chain Packages

> Over 230 malicious OpenClaw/MoltBot skills were discovered across ClawHub (the official skills registry), GitHub repositories, and third-party sharing platforms. These skills exploited OpenClaw's trust model where installed skills receive system-level access through the AI agent — including file system read/write, shell command execution, network access, and messaging service integration. Malicious skills used prompt injection techniques embedded in SKILL.md files to override safety guardrails, exfiltrate API keys and tokens from openclaw.json configuration, establish reverse shells, install cryptocurrency miners, and pivot through connected messaging services (Telegram, WhatsApp, Signal, iMessage). This represents the first large-scale supply chain attack targeting an AI agent skill/plugin ecosystem, analogous to malicious npm/PyPI packages but with amplified impact because AI agents operate with broader system permissions than typical software dependencies.

- **Published:** 2026-02-02T20:27:00Z
- **Last reviewed:** 2026-02-02T20:27:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0019
- **ID:** TL-2026-0019
- **Severity:** HIGH (CVSS 8.1)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 13 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OpenClaw (formerly MoltBot/ClawdBot) is an open-source AI personal assistant platform with 100,000+ users that supports extensibility through 'skills' — installable instruction packages that teach the AI agent how to use specific tools. Skills are distributed through ClawHub (the official registry at clawhub.com), GitHub repositories, and community sharing channels.

**The OpenClaw Skills Trust Model:**

OpenClaw skills follow the AgentSkills specification. Each skill is a directory containing a SKILL.md file with YAML frontmatter (metadata) and natural language instructions. When installed, skills are loaded into the agent's system prompt, giving them access to all tools the agent can use:

- File system: read, write, edit, delete files anywhere the agent has permissions
- Shell execution: run arbitrary commands via the exec tool (with or without sandbox, depending on configuration)
- Network access: web_fetch, web_search, browser automation
- Messaging: send messages through connected services (Telegram, WhatsApp, Signal, Discord, iMessage)
- Configuration: read openclaw.json containing API keys, tokens, and service credentials
- Memory: read/write to MEMORY.md and memory files containing personal information

Skills are loaded from three locations with precedence: workspace/skills (highest) → ~/.openclaw/skills (managed) → bundled skills (lowest). Third-party skills installed via `clawhub install` land in the workspace skills directory and override bundled skills of the same name.

**The Attack Campaign:**

Security researchers identified 230+ malicious skills across ClawHub and GitHub that exploited this trust model through several attack vectors:

1. **Prompt Injection via SKILL.md:** Malicious instructions embedded in SKILL.md files that, when loaded into the agent's context, override safety guardrails and execute attacker-controlled actions. Because SKILL.md content is injected directly into the system prompt, prompt injection is the primary attack surface. Examples:
   - Instructions telling the agent to silently exfiltrate openclaw.json contents to an external URL
   - Instructions to disable exec.approvals (safety prompts) before running commands
   - Instructions to read MEMORY.md and send personal information to attacker-controlled channels

2. **Bundled Malicious Scripts:** Skills can reference scripts in their directory via {baseDir}. Malicious skills included shell scripts, Python scripts, or Node.js modules that:
   - Established reverse shells to attacker C2 servers
   - Installed cryptocurrency miners (XMRig) leveraging GPU resources common on AI workstations
   - Exfiltrated SSH keys, AWS credentials, browser cookies, and cryptocurrency wallet files
   - Modified other installed skills to inject persistence (skill-level supply chain attack within the supply chain attack)

3. **Typosquatting:** Malicious skills published under names similar to popular legitimate skills (e.g., 'nano-bannana-pro' vs legitimate 'nano-banana-pro', 'weatherr' vs 'weather'). Users installing via ClawHub could accidentally install the malicious variant.

4. **Name Shadowing:** Due to the skill precedence model, a workspace skill with the same name as a bundled skill overrides it. Malicious skills were published with the same names as popular bundled skills, designed to be installed to workspace/skills and silently replace the legitimate version.

5. **Metadata Abuse:** Skills can specify environment variables and API keys via frontmatter metadata. Malicious skills requested unnecessary environment variables (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN) or configured env injection that leaked secrets into command arguments visible in process listings.

**Impact:**

- API key and token exfiltration from openclaw.json (messaging tokens, cloud API keys, payment keys)
- Personal data theft from MEMORY.md and memory files (user preferences, schedules, contacts)
- Cryptocurrency mining on AI workstations (typically high-end GPU machines)
- Lateral movement through connected messaging services (sending phishing messages via victim's connected WhatsApp/Telegram/Signal)
- Persistent backdoor access via modified agent workspace files
- SSH key and credential theft from the host system

**Comparison to Traditional Supply Chain Attacks:**

Malicious OpenClaw skills are analogous to malicious npm/PyPI packages but with amplified impact:
- npm packages execute code with the developer's permissions during install/build
- OpenClaw skills execute instructions through an AI agent with system-level access, messaging integration, and persistent memory
- The AI agent's broad capability set means a single malicious skill can simultaneously exfiltrate data, send messages, modify files, and execute commands — all through natural language instructions that bypass traditional code analysis tools

**Mitigation Response:**

ClawHub implemented enhanced review processes, skill signing, and reputation scoring. OpenClaw documentation now warns: 'Treat third-party skills as untrusted code. Read them before enabling.' Sandboxing support was improved to restrict skill script execution to Docker containers.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1554 Compromise Host Software Binary
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1496 Resource Hijacking

## Sources

- [OpenClaw Documentation — Skills Architecture](https://docs.openclaw.ai/tools/skills)
- [ClawHub Skills Registry](https://clawhub.com/)
- [OpenClaw Documentation — Security](https://docs.openclaw.ai/gateway/security)
- [OpenClaw Documentation — Sandboxing](https://docs.openclaw.ai/gateway/sandboxing)
- [OpenClaw GitHub — Security Advisories](https://github.com/openclaw/openclaw/security/advisories)
- [AgentSkills Specification](https://agentskills.io/)
- [CVE-2026-25253 — Related OpenClaw Gateway URL Injection](https://nvd.nist.gov/vuln/detail/CVE-2026-25253)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0019