Hackers Exploit OpenClaw Skills to Deliver Malware

OpenClaw runs locally and can execute shell commands, perform file operations, and make network requests, according to VirusTotal. That combination changes the practical risk model: a marketplace package can use both executable code and natural-language setup instructions to guide a user or agent toward downloading binaries, exporting environment variables, or running terminal commands.

Permiso's February research likewise reported finding a credential stealer disguised as a weather application while testing an OpenClaw agent with access to email, Slack, SharePoint, and calendar services. Its researchers characterized the concern as an emerging attack surface created when autonomous agents hold credentials across multiple business systems.

For security teams, this is an extension of familiar package-registry risk rather than a wholly separate category of malware. The notable difference is that an agent skill can combine dependency code, instructions interpreted by a model, and access to local tools. Comparable agentic systems often expand the impact of a compromised package because the package may operate near credentials, browser sessions, developer tooling, and messaging workflows.

Unit 42 reported in June that early February findings prompted ClawHub to integrate VirusTotal and ClawScan for proactive skill screening and code-level analysis. However, its February-May investigation identified five malicious skills that remained unblocked. Unit 42 said it reported those packages to ClawHub, after which OpenClaw banned the associated accounts and deleted the skills.

The five samples fell into three categories in Unit 42's analysis:

• •Two delivered macOS infostealers and communicated with command-and-control infrastructure.
• •One used an inflated file size intended to exceed scanner thresholds and evade ClawScan and VirusTotal detection.
• •Two used agentic techniques for affiliate injection and front-running intended for financial gain.

The ClawHavoc reporting therefore arrives against a documented pattern of malicious extensions and detection bypass attempts, not as an isolated warning. Unit 42 also reported that OpenClaw had begun requiring documentation of a skill's behavior and planned to run NVIDIA's analysis tool across skills.

Teams deploying self-hosted agents should treat skill installation as a privileged software-supply-chain event. Common controls in comparable environments include reviewing package source and code, limiting filesystem and network permissions, isolating agent runtimes, avoiding broadly available secrets, and monitoring outbound connections and process execution. Those controls do not establish whether any particular ClawHavoc victim was compromised, but they reduce the blast radius when a third-party extension proves malicious.