OpenClaw's 230+ Malicious Skills: Agentic AI Supply Chain Lessons

This updated guide reframes OpenClaw's 230+ Malicious Skills: Agentic AI Supply Chain Lessons around practical search intent: what readers need to compare, choose, install, secure, or operationalize in 2026. It focuses on decision criteria, workflow fit, and the trade-offs that matter once an AI agent, skill, marketplace, or automation moves from curiosity to daily use.

The article also broadens the semantic coverage around SKILL.md, AI agent skills, agent instructions. That gives readers a clearer path from high-level research to implementation planning, while keeping the content useful for teams evaluating AI agent skill design.

Quick Answer

A useful skill is narrow, repeatable, and explicit about inputs, tools, constraints, and success criteria, so the agent can act consistently instead of guessing.

• Ryan Rowcliffe
• Feb 2
• 9 min read

Updated: May 15

When Cisco's AI Defense team ran their Skill Scanner against OpenClaw's most popular community skill (one that had been gamed to the #1 ranking on the skills repository), they discovered nine security vulnerabilities. Two were critical. The skill, mockingly titled "What Would Elon Do?", was functionally malware: it covertly exfiltrated data to attacker-controlled servers and employed direct prompt injection to circumvent safety guidelines.

That malicious skill was downloaded thousands of times. And it represents just one of at least 230 malicious OpenClaw extensions uploaded to ClawHub since January 27, 2026.

If you have been tracking OpenClaw (formerly Clawdbot, then Moltbot), the open-source AI agent that promises to serve as your ideal digital assistant, you have witnessed something extraordinary: the agent accumulated 145,000 GitHub stars in weeks, demonstrating genuine appetite for autonomous AI assistants that truly help with everyday work.

You have also witnessed a real-world case study illustrating why identity security must evolve alongside agentic AI adoption. The OpenClaw ecosystem validates many of the supply chain and identity observability challenges discussed in this space. The difference is that this time, we get to learn by watching it unfold in real time rather than reconstructing failures from breach reports months after the fact.

Why OpenClaw Resonated With Users

Let's begin with what drove OpenClaw's adoption: it delivers real productivity gains.

Unlike AI demos that fall apart in production or assistants demanding constant hand-holding, OpenClaw proves the autonomous task execution model works in practice. Connect it to Claude or ChatGPT, point it at your messaging apps (WhatsApp, Telegram, iMessage, Slack), and it handles inboxes, schedules meetings, summarizes documents, books reservations, and runs workflows with minimal prompting.

The standout feature is persistent memory. The agent retains preferences, habits, and context across sessions stretching over weeks. It learns how you like your email organized, how you resolve calendar conflicts, and how you prioritize tasks. For professionals overwhelmed by digital busywork, this represents a tangible quality-of-life improvement.

The open-source model lets developers inspect code, customize behavior, and build integrations freely. No enterprise licensing headaches, no vendor lock-in, no waiting for official API support.

This is the agentic AI future that organizations have been anticipating. It also offers a chance to understand identity security challenges before they become pervasive problems.

The Extensibility Model: Innovation and Its Trade-offs

OpenClaw's strength comes from its extensibility. Similar to Claude Skills or OpenAI's custom GPTs, the platform supports community-contributed capabilities that broaden what agents can accomplish. These "skills" are instruction sets and code that teach the agent new abilities: API interactions, specialized analysis, and domain-specific workflow automation.

The trade-off for this innovation? There is currently no certification process, security review, or supply chain verification for community skills.

Cisco's research discovered that 26% of the 31,000 agent skills they analyzed contained at least one vulnerability. In OpenClaw's case, the architecture permits skills to:

Execute code on the host system with the agent's granted privileges Access environment variables including .env files that commonly contain API keys and database credentials Make external network calls to infrastructure outside the user's control Influence agent behavior through prompt engineering techniques Leverage the agent's memory system across sessions

The "What Would Elon Do?" skill demonstrated these capabilities working in concert:

Executed a curl command that transmitted data to an external server

Used prompt injection to manipulate agent behavior around safety checks

Required no additional user interaction beyond the initial skill installation

Left minimal audit trail of its activities

This is supply chain security colliding with agentic AI. The attack vector is not necessarily a sophisticated exploit. It is user trust in community code combined with the agent's broad access and credential visibility.

The Real Identity Challenge Explained

Let me walk through what happens when someone adopts OpenClaw while holding enterprise credentials. These scenarios illustrate the identity observability gap.

Scenario 1: The Well-Meaning Engineer

Sarah, a software engineer, learns about OpenClaw from her developer network. She is managing heavy message volume across Slack, JIRA tickets, and meeting requests. The promise of an AI assistant that genuinely helps is compelling.

Sarah installs OpenClaw on her work laptop and, following setup guides, connects it to:

Corporate Gmail account (OAuth access)

Slack workspace (bot token)

GitHub (personal access token)

Calendar (read/write permissions)

Local file system (where .env files containing AWS credentials and database passwords reside)

She installs community skills for email triage, code review assistance, and meeting optimization. One of those skills contains malicious code.

What happens next highlights the visibility challenge:

AWS credentials become accessible (potentially exposing production infrastructure)

GitHub personal access token is exposed (enabling repository access)

Database passwords from .env files are retrievable

Email history becomes available (potentially containing additional credentials)

Sarah believes she is running a personal productivity tool. The security team has no idea OpenClaw exists on the network. The credentials Sarah authorized appear legitimate because she granted them herself through standard OAuth flows. Traditional DLP does not flag the activity because data travels via encrypted HTTPS to what look like legitimate endpoints.

Scenario 2: The Remote Executive

Marcus, a VP of Sales, runs OpenClaw on his personal MacBook Pro at home. He has followed Docker hardening guidance and operates it in an isolated environment. His security awareness is actually above average for an executive.

But for OpenClaw to provide value, it requires access to work systems. Marcus authorizes it to:

Read and respond to corporate email (managing 300+ daily messages)

Access the company CRM (for deal pipeline visibility)

Connect to Slack (team coordination)

Integrate with calendar and scheduling tools

He installs a "CRM Assistant" skill that promises automated deal stage updates based on email sentiment analysis. The skill harvests credentials.

Marcus granted legitimate OAuth access, so the malicious skill inherits those permissions. The security team has limited visibility because access appears to originate from Marcus's authorized OAuth tokens.

This is not about Sarah or Marcus making poor decisions. It is about how existing identity governance models were never designed to track what happens after credentials are successfully retrieved and used by autonomous agents.

Why Traditional Security Controls Must Evolve

Security teams are applying established practices to the OpenClaw challenge: system isolation, least privilege access, credential vaulting, and network segmentation. These controls remain essential.

They are also revealing gaps that require attention.

System Isolation Addresses Host Security, Not Credential Usage

Even with perfect sandboxing using Docker, dropped Linux capabilities, and read-only filesystems (as Composio's hardening guide recommends), the agent still requires access to external systems to be useful. That access demands credentials, which become the new perimeter.

Vectra AI's analysis frames it well: "Autonomous AI agents must be treated as privileged infrastructure, not productivity tools."

Least Privilege Requires Redefinition for Autonomous Agents

The core value proposition of agentic AI is autonomous action across multiple systems. Restricting agents to read-only access or mandating manual approval for every action eliminates the productivity gains driving adoption.

Users will naturally seek workarounds: sharing broader credentials, running agents with elevated privileges, or migrating to external infrastructure where controls do not apply.

The challenge lies in redefining least privilege for autonomous entities that need meaningful capability to deliver value.

Credential Vaulting Addresses Storage, Not Observability

Tools like Composio offer brokered execution models where agents never encounter raw credentials. The platform injects them on the backend and returns results. This significantly improves credential protection.

But it does not resolve the broader visibility question: enterprises still need to understand what credentials are in use, by which agents, executing what actions, against which systems, and whether usage patterns align with expected behavior.

The vault protects the secret. It does not provide behavioral context about how that secret is being used.

Lessons from the Supply Chain

The malicious skills proliferation on ClawHub delivers valuable insights about agentic AI supply chain security. We are observing familiar patterns from software supply chains (package abandonment, typosquatting, malicious updates) but with an added dimension: compromised components have direct credential access and autonomous execution capability.

Consider what the timeline reveals:

January 27, 2026: Security researchers begin documenting malicious skills on ClawHub January 29, 2026: Deliberately backdoored "safe" skill published as security test; downloaded thousands of times January 30, 2026: Fake "ClawdBot Agent" VS Code extension identified as credential harvesting malware February 1, 2026: Count of malicious extensions reaches 230+, primarily targeting crypto credentials

Running in parallel: CVE-2026-25253 (CVSS 8.8, one-click code smuggling), CVE-2025-6514 (RCE in mcp-remote), and multiple WebSocket hijacking exploits.

These are not just OpenClaw problems. They preview how agentic AI supply chains will be targeted going forward. Rapid growth creates openings for supply chain compromise. Malicious actors manufacture popularity through ranking manipulation, exploit naming confusion during rebrands, and release "helpful" tools that harvest credentials.

Security researcher Jamieson O'Reilly (now working with the OpenClaw project on security) documented hundreds of instances exposed to the internet with no authentication, leaking plaintext API keys, bot tokens, OAuth credentials, and conversation histories.

GitGuardian's 2024 State of Secrets Sprawl report found 12.8 million secrets leaked on public GitHub in 2023, a 28% year-over-year increase. Agentic AI architectures that centralize credentials risk accelerating this trend.

The Identity Observability Gap Exposed

The OpenClaw experience spotlights a fundamental challenge: traditional Identity tools and Governance and Administration (IGA) platforms were designed around human identities accessing systems through predictable patterns. They excel at tracking provisioning, certification campaigns, role assignments, and access reviews.

What they do not track effectively is what occurs after authentication succeeds and credentials are actively in use.

When Sarah's OpenClaw agent retrieves her AWS credentials and executes infrastructure commands, existing Identity platforms see: Sarah accessed AWS (authorized).

What they miss:

Access was initiated by an autonomous agent, not Sarah directly

Credentials were shared with community code of uncertain provenance

Usage patterns deviate from Sarah's normal behavior

Data movement occurred to external infrastructure

When Marcus's agent uses his legitimate CRM OAuth tokens to bulk-export customer data, audit logs show: Marcus accessed CRM (authorized).

What remains invisible:

Access came from an autonomous agent on a personal device

Data retrieval pattern is inconsistent with Marcus's typical usage

External network connections immediately followed data access

A third-party skill orchestrated the sequence

This is the "what happens after credentials are successfully retrieved" visibility problem. With non-human identities now outnumbering human identities 144:1 (exceeding even industry forecasts), and agentic AI accelerating autonomous credential usage, organizations need identity behavior visibility, not just identity administration tracking.

Moving Forward: Practical Steps for Organizations

The good news: these challenges are solvable with the right approach and tools. Organizations do not have to choose between innovation and security. They need visibility into both.

Immediate Actions (30-60 days):

1. Map Your Current Agentic AI Footprint You cannot govern what you cannot see. Start by identifying:

Authentication patterns suggesting agent usage (rapid API calls, off-hours access)

New OAuth grants or token generation consistent with agent authorization

Traffic to known agentic AI platforms and MCP/A2A protocol endpoints

Presence of agent frameworks in your environment (OpenClaw, LangChain, AutoGPT artifacts)

2. Assess Credential Exposure Surface Identify which credentials and access tokens could be accessible to agents:

.env files and environment variables on developer systems

Personal access tokens for code repositories (GitHub, GitLab)

Cloud provider credentials (AWS, Azure, GCP) stored locally

OAuth tokens with broad scopes that agents could leverage

3. Establish a Behavioral Baseline Traditional authentication logs will not surface credential misuse by agents. Implement behavioral analytics that track:

Credentials used from unexpected locations or contexts

Access patterns inconsistent with credential owner's normal behavior

Data retrieval followed by external network connections

Secrets accessed but not used for their intended purpose

Strategic Development (60-180 days):

4. Build Agent Identity Frameworks Start developing "Know Your Agent" (KYA) capabilities:

Registry of approved agents with explicit capabilities and access boundaries

Developer verification and code signing for agent deployments

Consent capture documenting which users authorized which agents

Governance controls to manage compromised or misbehaving agents

5. Deploy Identity Observability Implement platforms providing continuous visibility into identity usage patterns:

Real-time monitoring of credential usage across human and non-human identities

Anomaly detection for unusual access patterns

Correlation between authentication success and subsequent actions

Audit trails that persist beyond agent lifecycle

6. Adopt Brokered Credential Models Where feasible, eliminate direct credential sharing between users and agents:

Platforms that inject credentials on the backend without agent exposure

Just-in-time credential generation with short time-to-live

Agent-specific credentials that can be independently revoked

Detailed logging of every action agents perform

Looking Ahead

OpenClaw will likely be overtaken by other agentic platforms within months. The project's creator Peter Steinberger has been transparent that it is an experimental hobby project, not a hardened enterprise product. The rapid rebranding (Clawdbot to Moltbot to OpenClaw) and security evolution represent an experiment that went viral before reaching maturity.

But the pattern OpenClaw represents, autonomous agents with broad system access and community extensibility, reflects the direction of agentic AI broadly. Microsoft's Copilot, Anthropic's Claude, OpenAI's GPT variants, and numerous enterprise platforms are all moving toward agents that take action on users' behalf.

The question for security teams is not whether to permit this evolution. It is whether organizations will have the visibility and controls needed when it arrives.

IBM Research Scientist Kaoutar El Maghraoui captured the balance: "A highly capable agent without proper safety controls can end up creating major vulnerabilities, especially if it is used in a work context."

The 230+ malicious skills uploaded to ClawHub in a single week validate the supply chain challenges that have been tracked in this space. The identity observability gaps that traditional IGA platforms struggle with are now visible through concrete examples rather than theoretical scenarios.

Organizations have an opportunity: build comprehensive visibility into identity usage patterns now, learning from OpenClaw's experience, rather than developing these capabilities reactively after incidents occur.

Collaborating on This Challenge

At Authmind, we are watching the OpenClaw ecosystem evolution closely because it demonstrates exactly the identity observability challenges we have been helping organizations address. The gap between "credential was authorized" and "credential is being used appropriately by the expected entity" is where modern identity security must focus.

We do not claim to have all the answers. This space is evolving rapidly. But we do understand the challenge of providing visibility into what happens after authentication succeeds, especially as non-human identities and autonomous agents become the dominant identity type in enterprise environments.

The OpenClaw experiment reveals what happens when autonomous execution meets uncertified extensibility in real-world conditions. For security teams expanding their identity governance thinking beyond human-centric models, it is a valuable preview of the challenges (and opportunities) ahead.

We are learning alongside everyone else in this space. And we are here to help organizations build the visibility they need as agentic AI adoption accelerates. To see a demo of the AuthMind platform to rapidly discover GenAI usage in your organization, click here.

Related Reading

• MCP Security: Risks and Best Practices 2026 Guide
• OpenClaw Security Risks: Skills, Exposure and Exploits 2026 Guide
• ToxicSkills - malicious AI agent skills