OpenClaw AI Agent Skills Abused by Threat Actors to Deliver Malware
A recent analysis by VirusTotal has revealed a noteworthy malware distribution campaign targeting the OpenClaw ecosystem, an AI agent platform previously known as Clawdbot and Moltbot.
A recent analysis by VirusTotal has revealed a noteworthy malware distribution campaign targeting the OpenClaw ecosystem, an AI agent platform previously known as Clawdbot and Moltbot.
OpenClaw extends its functionality through skills, which are small packages available on ClawHub, a public marketplace for OpenClaw extensions. These skills, comprised of SKILL.md files, are designed to enhance automation capabilities. However, they can also pose significant security risks as they operate with full system access, often requiring users to execute commands, download binaries, or run scripts.
Threat actors are exploiting this model by distributing malware disguised as useful tools. VirusTotal Code Insight has evaluated over 3,016 OpenClaw skills, identifying hundreds with malicious attributes. The analysis, powered by Gemini 3 Flash, focuses on security behaviors such as external code execution and unsafe network operations, rather than relying solely on traditional antivirus signatures.
Malicious Skills and Threat Categories
Security researchers have categorized the threats into two main groups:
OpenClaw extends its functionality through skills, which are small packages available on ClawHub, a public marketplace for OpenClaw extensions.
Skills with poor security practices, including insecure APIs, hardcoded secrets, and unsafe command execution. Intentionally malicious skills designed for data exfiltration, remote control, and malware installation.
A significant case involves a ClawHub user, "hightower6eu," who published 314 malicious skills related to crypto analytics, finance tracking, and social media analysis. These skills direct users to download and execute external code from untrusted sources. For example, a "Yahoo Finance" skill appeared clean to traditional antivirus engines but was identified by VirusTotal Code Insight as instructing users to download a password-protected ZIP file containing a packed trojan.
For macOS users, a Base64-obfuscated shell script was used to download and execute a Mach-O binary identified as Atomic Stealer (AMOS), targeting passwords, browser credentials, and cryptocurrency wallets.
Organizations and users are advised to treat skill folders as trusted-code boundaries, implement sandboxed execution, and avoid skills that require shell commands or binary downloads. Marketplace operators should implement publish-time scanning to identify remote execution and obfuscated scripts.
VirusTotal is considering integration with OpenClaw's publishing workflow to provide automated security analysis during skill submission.
Based on reporting by Cyber Security News.