Malicious OpenClaw skills turn agent access into credential risk

At a glance

What this is: This is an incident response guide for suspected malicious OpenClaw skills, centred on containment, skill removal, credential rotation, and post-cleanup hardening after ClawHavoc-style compromise.

Why it matters: It matters because AI agent skills can access files, tokens, and sessions as if they were trusted operators, so compromised skills create an identity and credential exposure problem, not just a malware cleanup task.

Context

OpenClaw skills behave like delegated execution paths, which means a malicious skill can inherit real access to files, sessions, and secrets once installed. The governance gap is not only malware detection, but the assumption that a skill’s documentation or packaging reflects its trustworthiness. When that assumption fails, the environment must be treated as a compromised identity surface, not a broken app.

The article points to the ClawHavoc campaign as the practical example: malicious skills can be disguised as ordinary productivity or crypto tools while quietly creating callback traffic, downloading payloads, or harvesting credentials. That makes skill onboarding, filesystem access, and session exposure part of the same control problem, especially when the agent runs on a primary machine rather than an isolated environment.

Key questions

Q: What should organisations do after discovering a malicious AI skill?

A: They should revoke the skill, inspect downstream agent activity, and identify any credentials, APIs, or transaction paths the skill could have touched. The response should treat the event as a supply-chain compromise, not just a bad plugin. That means containment, lineage review, and restoration of trust boundaries.

Q: Why do malicious AI agent skills create data exfiltration risk?

A: Because the skill can inherit the agent’s existing filesystem, network, and secret access, then use that access through bundled scripts or instruction-driven behaviour. The risk rises when credentials and egress paths are broad enough that a skill can read environment files, harvest keys, or send data out without a separate privilege escalation.

Q: Where do incident responders usually miss persistence in agent compromise cases?

A: They often stop at the visible skill directory and miss the artifacts that survive it. LaunchAgents, cron jobs, systemd services, helper binaries, browser profiles, and stored agent memory can all preserve attacker control after the original skill is deleted. The compromise is cleared only when all of those paths are checked.

Q: How can security teams reduce the blast radius of a compromised agent skill?

A: By narrowing what the skill can read, where it can send data, and which runtime inputs it can treat as instructions. The goal is to stop a single malicious skill from turning local secrets and trusted tool access into broader exfiltration or lateral spread. That requires layered runtime controls, not just pre-install review.

Technical breakdown

How malicious OpenClaw skills persist after installation

Malicious skills can hide their real purpose behind normal-looking folders, documentation, or prerequisite downloads. Once installed, they may drop additional binaries, create LaunchAgents or systemd services, or modify startup behavior so they survive simple deletion. In this pattern, the dangerous object is not only the skill code itself, but any adjacent executable or persistence artifact that continues acting after the skill directory is removed. That is why incident response has to include filesystem inspection outside the nominal skill path. See the Incident Response Guide.

Practical implication: Search beyond the skill folder for startup hooks, helper binaries, and service definitions before declaring the compromise cleared.

Why credential theft is the primary OpenClaw risk

OpenClaw skills can reach environment variables, .env files, SSH material, browser sessions, and other local secrets if permissions are broad enough. That means a malicious skill does not need classic exploit chaining to cause damage; it only needs the identity and access already granted by the host environment. The same access path can expose API keys, tokens, browser cookies, and cloud credentials in one session. In identity terms, the skill becomes a high-trust delegate with too much reach. Read Guide to NHI Rotation Challenges.

Practical implication: Treat every reachable secret as compromised until it has been revoked, rotated, or reissued from a clean device.

How OpenClaw memory can reintroduce malicious behaviour

Some agent systems retain memory, conversation history, or long-lived state across sessions. If a malicious skill poisons that memory, the agent can re-run unsafe instructions after the visible malware is removed, creating a sleeper behaviour pattern rather than a one-time infection. This is especially dangerous when operators clean the file system but leave persistent context intact. The mechanism is subtle because the artifact is not always a binary; it can be a stored instruction set that survives the cleanup event. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Clear persistent agent memory and history whenever a skill compromise may have influenced long-lived context.

Threat narrative

Attacker objective: The attacker’s objective is to maintain access to secrets and sessions long enough to steal credentials, exfiltrate data, and preserve a foothold even after the visible skill is removed.

1. Entry occurred when the user installed a malicious OpenClaw skill that masqueraded as a normal utility and in some cases instructed the operator to install a hidden prerequisite binary. The installation path gave the attacker a trusted execution foothold inside the agent environment.
2. Credential access followed when the skill read .env files, accessed ~/.ssh directories, scanned for API keys, or harvested browser and keychain data from the host. The article also describes callback traffic to command-and-control infrastructure and secondary payloads such as AMOS.
3. Escalation and persistence came from helper binaries, startup hooks, and other artifacts outside the skill directory that could survive simple deletion. That let the malware continue running or reappear after the initial cleanup attempt.
4. Impact was theft of API keys, passwords, SSH keys, session tokens, browser data, and possibly cryptocurrency wallet material, with some skills also creating reverse shells or ongoing exfiltration channels.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OpenClaw skills create a delegated identity problem, not just a malware problem. The guide is really about what happens when a tool package inherits operational trust, then uses that trust to read secrets, open sessions, and call out to remote infrastructure. That makes the skill lifecycle a governance issue for autonomous execution paths, not only a malware detection issue. Practitioners should treat every skill as an access-bearing identity until proven otherwise.

Long-lived agent trust debt is the right concept for this incident pattern. The skill is installed once, but the access it receives can persist across sessions, browser profiles, cached memory, and external helper processes. The article’s emphasis on rotation, cleanup, and hardening shows that the risk window is not just during execution, but across the full period in which the agent remains trusted. The implication is that installation trust and runtime trust must be separated much more aggressively.

Identity review breaks down when a malicious skill can act faster than governance can react. If a skill is able to read secrets and exfiltrate them before any human notices, then access review after the fact is too late to prevent loss. That is the same structural problem seen in other non-human identity incidents, where standing access and weak isolation turn a single installation event into broad compromise. Rotation challenges for non-human identities become the practical lens for this control gap.

What fails here is the assumption that removal of the visible skill equals removal of the threat. The article repeatedly shows that persistence can live in helper binaries, browser profiles, session state, and agent memory. That means cleanup is not an asset-deletion exercise; it is a trust-revocation exercise across the whole execution environment. Practitioners should reframe compromise response around residual authority, not just malicious code.

Environment isolation is the only control that reliably limits blast radius once a skill is granted local access. The article’s advice to move OpenClaw off the primary machine reflects a broader identity principle: if the delegate can reach everything, the delegate can steal everything. Segmentation, sandboxing, and least-access configuration are therefore not nice-to-haves but boundary controls for the entire agent model. The practitioner conclusion is simple: isolate before you trust.

What this signals

The next governance step is to treat agent skills as privileged delegates with full lifecycle controls, not as lightweight extensions. That means onboarding, permissioning, isolation, revocation, and residual-state cleanup all belong in the same operating model, because compromise can survive the deletion of the obvious artifact.

Residual authority problem: a compromised agent environment can keep trust alive through memory, sessions, startup hooks, and helper binaries after the visible skill is removed. Practitioners should assume the true control boundary is the entire execution context, not the named skill package.

For practitioners

• Isolate the agent host immediately Disconnect the OpenClaw instance from the network, stop the gateway process, and freeze the environment before any cleanup or restart can trigger more payload activity.
• Delete the entire malicious skill path Remove the full skill directory and any prerequisite binaries, scripts, or archives referenced by the skill documentation, including files in Downloads, /tmp, or other helper paths.
• Rotate every exposed credential Revoke API keys, reset passwords, regenerate SSH keys, invalidate sessions, and replace any wallet material that may have been reachable from the compromised environment.
• Hunt for persistence beyond the skill folder Inspect LaunchAgents, cron jobs, systemd services, unexpected executables, browser profiles, and agent memory for artifacts that could keep the compromise alive after deletion.
• Tighten the agent’s permission model Restrict filesystem access, disable shell execution where unnecessary, bind the gateway locally, and enable sandboxing for sessions that do not need broad host reach. See the AI Agent Observability, Audit and Incident Response Guide.

Key takeaways

• Malicious OpenClaw skills turn agent trust into a credential and session exposure problem, so incident response has to begin with containment, not cleanup.
• The article’s evidence shows that persistence can survive skill deletion through helper binaries, startup hooks, browser state, and agent memory.
• The limiting control is not a single scan but a tighter operating model that isolates the agent, revokes exposed secrets, and removes residual authority.

Related NHI Mgmt Group resources: Incident Response Guide · Guide to NHI Rotation Challenges · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Residual Authority: Residual authority is the access that remains usable after the original object that granted it has been removed. For agent compromises, that can include cached sessions, helper binaries, memory, startup hooks, and stored credentials, all of which can preserve attacker reach beyond the visible compromise point.
• Persistence artifact: A persistence artifact is any file, hook, service, or configuration that lets malware survive after the initial execution window ends. In build and developer environments, these artifacts often hide in editor settings, system services, or startup hooks and can reactivate the compromise later.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.