Skip to main content

Skill Verification

Skills are instructions, and often scripts, that your agent follows with its own tools. Upstream's guidance is to treat third-party skills as untrusted code and read them before enabling them (skills: security). The commands below were checked against OpenClaw v2026.10.4 on 2026-10-18.

Why it matters: in February 2026, researchers found 341 malicious skills on ClawHub, and Snyk found security flaws in 36% of the 3,984 skills it sampled. The studies, and what ClawHub changed afterwards, are on Known Vulnerabilities. These are early-2026 figures; ClawHub's scanning has changed since (see ClawHub scanning).

The Threat Landscape​

How malicious skills work​

Traditional malware (ClawHavoc):

  1. The skill has a "Prerequisites" section.
  2. It tells the user to download a password-protected ZIP or run an obfuscated shell script.
  3. The download is Atomic Stealer (AMOS), a macOS infostealer that targets Keychain passwords, browser credentials and crypto wallets.
  4. The skill itself may work, which provides cover.

Prompt injection (91% of malicious skills in Snyk's sample):

  1. The skill's instructions contain hidden directives for the model.
  2. The model is told to exfiltrate data, create backdoors, or edit SOUL.md.
  3. No malware is needed; the agent's own tools do the work.

Credential leaks (283 skills):

  1. Working skills tell the agent to pass API keys through the model context.
  2. The keys end up in transcripts, logs and generated files.

Pre-Installation Checklist​

1. Check ClawHub's audit result​

Every ClawHub release carries an audit status and risk level, shown on its page before you install (ClawHub security audits):

StatusMeaning
PassNo visible issue above low risk
ReviewRead the findings before installing; may still be legitimate
WarnA high-impact concern or warning signal
MaliciousDo not install
PendingScans have not finished
ErrorThe audit could not complete

From the CLI, fetch the same trust envelope (clawhub.skill.verify.v1) (openclaw skills):

openclaw skills verify @owner/<slug>                     # JSON envelope
openclaw skills verify @owner/<slug> --card              # readable Skill Card
openclaw skills verify @owner/<slug> --version <version>

verify exits non-zero when ClawHub marks verification as failed. When ClawHub has kept them, the JSON includes the full SkillSpector and AIG scanner reports under security.scannerReports. Use owner-qualified refs (@owner/<slug>) to avoid picking up a lookalike publisher.

A pass is a signal, not a guarantee. Since 2026-10-13 new ClawHub releases stay unpublished until their pre-publication scans pass (see below), but releases from before that date and later rescans can still show a pending or stale result, and installation may proceed with a warning. Installation is not proof that every scan completed (why OpenClaw).

2. Check Against Koi Security's Database​

Clawdex is Koi Security's own lookup of skills against its malicious-skills database. Check the skill there by name. OpenClaw has no built-in Clawdex integration.

3. Review the source​

Read SKILL.md and every script before installing. With the standalone ClawHub CLI you can inspect a release without installing it (ClawHub CLI):

npm i -g clawhub
clawhub inspect @owner/<slug> --versions
clawhub inspect @owner/<slug> --files
clawhub inspect @owner/<slug> --file SKILL.md

For a Git-hosted skill, clone it, read it, then install from the reviewed directory:

openclaw skills install ./reviewed-skill --as reviewed-skill

Red flags:

Red flagExampleRisk
"Prerequisites" with downloads"Download this ZIP first", "run this script"AMOS-style malware delivery
curl ... | bash anywhere in instructions or scriptsFetching and running unknown codeMalware installation
Password-protected archivesZIPs that need a password to openEvades scanners
Obfuscated contentBase64 blobs, packed scripts, zero-width charactersHidden behaviour
Hardcoded external URLshttps://random-domain.xyz/collectData exfiltration
Credential paths~/.ssh, ~/.aws, ~/.openclaw/credentialsCredential theft
Instructions aimed at the model"Ignore previous instructions", "update your SOUL.md"Agent hijacking, persistence
Asking you to paste API keys into chat"Send me your OpenAI key to configure"Keys land in transcripts
More tools than the task needsA formatter that needs shell and browserOver-privileged

4. Check the author​

On the skill's ClawHub page, look at the owner, source repository, version history, changelog, downloads and stars. Publishing requires a GitHub account at least 14 days old as of 2026-10-18 (ClawHub security and moderation spec). At the time of ClawHavoc the requirement was one week, so an established account is a weak signal at best.

5. Check community signal​

  • New skills with few installs and no history deserve extra scrutiny.
  • Search the skill name in the OpenClaw Discord and GitHub issues.
  • Reports do not hide a skill automatically. As of 2026-10-18, ClawHub's spec says reports "never change skill visibility or installability automatically"; moderators review them. Older guides that mention auto-hiding after 3 or 4 reports are out of date.

Safe Installation Practices​

# Install an exact, reviewed version into one agent's workspace
openclaw skills install @owner/<slug> --version <version> --agent <id>

# Confirm what the agent can actually see
openclaw skills check --agent <id>
openclaw skills info <name>
  • Pin the version you reviewed with --version. openclaw skills update --all replaces skills with newer releases, which you have not reviewed. With the standalone CLI, clawhub pin <skill> freezes an installed skill.
  • Don't use --force-install. It installs a pending GitHub-backed skill before ClawHub's scan completes.
  • Know what isn't scanned. skills-sh:, git: and local directory installs are marked Not scanned by ClawHub, and that trust state is kept through updates.
  • Install per agent, not globally, until you trust a skill. --global installs into ~/.openclaw/skills, which every local agent can see.
  • Skills can't be sandboxed individually. There is no --sandbox or --no-shell install flag. Sandboxing applies per agent or session (agents.defaults.sandbox, agents.entries.<id>.sandbox). Skill secrets in skills.entries.*.env and apiKey are injected into the host process, not the sandbox.
  • Path containment. Skill roots must resolve inside their configured directory unless skills.load.allowSymlinkTargets trusts a target (skills: security).
  • Metadata moved. ClawHub tracking now lives in .clawhub/. The pre-July-2026 .clawdhub/ directory is no longer read; rename it before updating or verifying older installs.

Principle of least privilege​

OpenClaw has no per-skill permission grants. A skill can use whatever tools its agent has, so give risky skills their own agent:

Skill typeAgent configuration
Information lookuptools.profile: "messaging", deny group:runtime and group:fs
Code formattingSandbox with workspaceAccess: "rw", no network (docker.network: "none" is the default)
Deployment automationExec with tools.exec.mode: "ask" or an allowlist; scoped deploy credentials
Browser tasksStrict browser.ssrfPolicy, no exec

For example:

~/.openclaw/openclaw.json
{
  agents: {
    entries: {
      research: {
        sandbox: { mode: "all", scope: "agent", workspaceAccess: "none" },
        tools: {
          profile: "messaging",
          deny: ["group:runtime", "group:fs"],
          exec: { mode: "deny" },
        },
      },
    },
  },
}

See tool and agent permissions and Security Hardening: sandboxing.

Automated Scanning​

Built-in code safety scanner​

OpenClaw has a skill and plugin code safety scanner, added in v2026.2.6 (CHANGELOG/2026.2.6.md upstream). There is no openclaw security scan command. The scanner runs on installed skills as part of the deep audit and reports skills.code_safety.* findings (audit checks):

openclaw security audit --deep
openclaw security audit --deep --json | jq '.findings[] | select(.checkId | startswith("skills."))'

ClawHub scanning​

Since 2026-10-13, every new skill version and package release on ClawHub is stored as pending and becomes installable only after the TruffleHog and ClawScan pre-publication checks pass on that exact artifact. A malicious verdict blocks the release; a scanner failure or timeout leaves it unpublished. Before that change, a deployment flag decided whether checks ran before or after a release went public (clawhub PR #3947). Releases are also rescanned later. Sources include VirusTotal, ClawScan and static analysis, plus SkillSpector and AIG reports where retained (openclaw skills, ClawHub CLI: scan). Upstream's threat model notes that VirusTotal and LLM-based review depend on ClawHub's operator-side configuration being enabled (THREAT-MODEL-ATLAS). At install time, OpenClaw refuses community releases that ClawHub marks malicious or blocked.

Third-party scanning tools​

Not reviewed by clawdocs. Vet them like any other code you run.

ToolWhat it does
ClawdexLookup against Koi Security's malicious-skills database
Cisco Skill ScannerStatic, dataflow, LLM and VirusTotal-based skill scanning
Snyk agent-scanScans MCP servers and agent skills (formerly mcp-scan)
SafeClaw ScannerLooks for prompt injection, backdoor commands and obfuscation

Restrict or block installs​

There are no skills.allow_install or allow_clawhub keys. Two real controls exist (skills config):

  • security.installPolicy runs a trusted local command before every skill and plugin install or update: ClawHub, Git, local, uploaded and dependency installers. It can return allow, warn or block. With enabled: true and no working command, installs are blocked, so a command that always blocks disables installs entirely.
  • skills.allowBundled limits which bundled skills are eligible. It doesn't affect workspace or managed skills.
~/.openclaw/openclaw.json
{
  security: {
    installPolicy: {
      enabled: true,
      targets: ["skill"],
      exec: {
        source: "exec",
        command: "/usr/local/bin/openclaw-install-policy",
        args: ["--json"],
        trustedDirs: ["/usr/local/bin"],
      },
    },
  },
  skills: {
    allowBundled: ["gemini", "peekaboo"],
  },
}

--force does not override a block. Neither does --acknowledge-install-policy-warning, which only accepts warn results after review.

Post-Incident: If You Installed a Malicious Skill​

  1. Remove the skill. For ClawHub installs, use the standalone CLI (remove a ClawHub skill):

    clawhub --workdir /path/to/agent-workspace uninstall @owner/<slug>
    clawhub --workdir ~/.openclaw uninstall @owner/<slug>    # if installed with --global

    For Git or local installs, delete the skill directory from the workspace skills/ folder.

  2. Rotate the Gateway token properly, then every API key and channel token the agent could reach. See incident response.

  3. Check for plaintext secrets: openclaw secrets audit --check.

  4. Check workspace files (~/.openclaw/workspace/SOUL.md, AGENTS.md, MEMORY.md) for changes, and openclaw cron list for scheduled persistence.

  5. Review activity: openclaw audit --kind tool_action, openclaw logs, and the affected transcripts (openclaw transcripts list).

  6. Scan the host with your OS malware scanner, and check browser profiles for stolen sessions.

  7. Run openclaw security audit --deep until no critical findings remain.

Reporting Malicious Skills​

  • On ClawHub: sign in and use Report skill on the skill's page (ClawHub moderation). Moderators review reports.
  • A vulnerability in ClawHub itself (scanning, moderation, downloads, auth): a GitHub Security Advisory on openclaw/clawhub.
  • A vulnerability in OpenClaw that a skill exploits (an auth, policy or sandbox bypass): a private advisory on openclaw/openclaw. A skill that is merely malicious is a ClawHub moderation matter, not an OpenClaw advisory (SECURITY.md).

See Also​