ClawHavoc - how malicious skills reached OpenClaw agents

Facts

• Koi audited 2,857 ClawHub skills. 341 were malicious. 335 of those installed the AMOS macOS stealer.
• Snyk ToxicSkills scanned 3,984 skills. 13.4% had a critical issue. 36.8% had some flaw.
• Unit 42 found 5 malicious skills that passed both VirusTotal and ClawScan.

How the attack works

1. The skill looks useful and has a normal README.
2. The README lists a "prerequisite". It is a shell one-liner or a download.
3. The agent runs it, because the skill told it to.
4. The payload steals browser data, keychains and API keys.

The skill never needs to contain malware. The instructions are the malware.

Check what you have installed

npx -y securemyagent checkup

The Checkup hashes each installed skill and looks it up in the Verdict Registry. Unknown skills are queued for scanning.

Find skills with install-style commands yourself:

grep -rEn "curl[^|]*\|[ ]*(ba)?sh|wget[^|]*\|[ ]*(ba)?sh|base64 (-d|--decode)|chmod \+x" ~/.openclaw 2>/dev/null | head -50

Adjust the path to where your runtime keeps skills.

Fix

sma remove-skill <skill-id>

Then:

1. Rotate every key the agent could read: API keys, GitHub tokens, cloud credentials.
2. Move secrets out of plaintext with sma fix --vault.
3. Re-run npx -y securemyagent checkup.

Rules for new skills

• Read the whole skill before install. Search for curl, wget, sudo, base64.
• Never run a "prerequisite" command from a skill README without a human reading it.
• A clean VirusTotal result is not a clean verdict. Unit 42 showed scanners miss instruction-based malware.
• Check before install: sma check <skill>.

Related: fix installed components.