Malicious Skills on ClawHub Put OpenClaw Users at Risk

A recent security audit conducted by Koi Security has uncovered a disturbing trend on ClawHub, a marketplace for OpenClaw users to find and install third-party skills. The audit of 2,857 skills found 341 malicious skills, highlighting a significant risk to users who rely on this platform to extend the functionality of their self-hosted artificial intelligence (AI) assistant.

ClawHub, designed to simplify the discovery and installation of skills for OpenClaw, inadvertently exposes its users to new supply chain risks. These malicious skills, part of multiple campaigns, are capable of stealing data from OpenClaw users, compromising their privacy and security.

Also Read: Frontier AI Agents: The Ethics Conundrum - When KPIs Clash with Moral Constraints
  • The presence of 341 malicious skills out of 2,857 audited indicates a substantial threat landscape.
  • These skills can lead to data breaches, compromising sensitive user information.
  • The discovery underscores the need for rigorous security audits and vetting processes for third-party skills.

As the use of AI assistants like OpenClaw continues to grow, the importance of securing their ecosystems, including marketplaces like ClawHub, becomes increasingly critical. Users must remain vigilant and demand higher security standards from platforms they trust with their data.

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

Bruce Schneier