OpenClaw’s AI Skill Extensions Raise Serious Security Concerns

OpenClaw, the AI assistant that has surged in popularity recently, is now facing serious security issues after researchers discovered malware hidden in numerous user-submitted “skill” add-ons on its marketplace. In a recent update, a product VP highlighted that OpenClaw’s skill hub has turned into a potential target for attacks, with the most popular add-on acting as a “malware delivery vehicle.”

Originally known as Clawdbot and later Moltbot, OpenClaw is designed to be an AI agent that “actually does things,” like managing calendars, checking in for flights, and tidying up inboxes. It operates locally on devices, allowing users to interact with it through messaging platforms such as WhatsApp, Telegram, and iMessage. However, some users are granting OpenClaw extensive access to their devices, enabling it to read and write files, execute scripts, and run shell commands.

This level of access is concerning on its own, but the presence of malware disguised as skills intended to enhance OpenClaw’s functionality only heightens the risks. A platform tracking malware in the open-source ecosystem reported that 28 malicious skills were uploaded to the ClawHub skill marketplace between January 27th and 29th, along with 386 more between January 31st and February 2nd.

These malicious skills often pose as cryptocurrency trading automation tools, delivering information-stealing malware and tricking users into executing harmful code that can steal crypto assets, including exchange API keys, wallet private keys, SSH credentials, and browser passwords.

The product VP pointed out that many of OpenClaw’s skills are uploaded as markdown files, which can contain harmful instructions for both users and the AI. This was evident in one of ClawHub’s most downloaded add-ons, a “Twitter” skill that directed users to a link designed to execute a command that downloads infostealing malware.

In response to these security concerns, OpenClaw’s creator is implementing measures to mitigate risks, including requiring users to have a GitHub account that’s at least a week old to publish skills. There’s also a new reporting mechanism for skills, although this doesn’t eliminate the risk of malware infiltrating the platform.