OpenClaw skills show how AI extensions become malware channels

At a glance

What this is: This research audits the OpenClaw skill marketplace and finds that AI extensions can function as malware delivery channels, not just benign add-ons.

Why it matters: It matters because skills that execute locally with broad authority change identity governance, supply-chain risk, and credential exposure for agentic AI programmes.

Context

OpenClaw skills are packaged extensions that add capabilities to AI agents, but the article shows that they can also execute locally with host-level authority. That changes the governance problem from prompt safety to executable software control, especially when skills are installed through a marketplace and inherit access to environment variables, files, and network connections.

Lakera frames the issue as a supply-chain and execution boundary problem. The central question is no longer whether the model can be persuaded to say something unsafe, but whether third-party code can run with enough privilege to fetch payloads, harvest credentials, and move data out of the environment.

For AI agent programmes, this is an agentic governance issue rather than a simple extension hygiene issue. The article’s starting position is atypical in its scale, but the control failure it describes is already common across software ecosystems: distribution is treated as trust, while execution authority is granted without enough inspection.

Key questions

Q: What breaks when AI serving engines run with excessive privileges?

A: Excess privilege lets a compromised inference service reach host resources, GPU drivers, local files, or internal networks that should be off limits. That turns a model-serving issue into a broader workload compromise and makes lateral movement much easier.

Q: Why do over-provisioned OAuth scopes make agent skills more dangerous?

A: Because the token becomes a blast-radius multiplier. If a skill is compromised, every extra repository, cloud service, or connected account in its scope becomes available to the attacker. In agentic systems, scope minimisation is not just least privilege theory, it is the difference between a contained compromise and a broad one.

Q: How can security teams tell when a skill marketplace is failing governance controls?

A: Look for symptoms such as broad default permissions, opaque external endpoints, shell invocation inside skill code, and no mandatory review before publication. Those signals show that the marketplace is distributing execution authority faster than it is validating trust. A healthy programme forces pre-execution scrutiny, not post-incident discovery.

Q: How should organisations respond when a skill may have exposed secrets or run malware?

A: Assume credential compromise first, then verify scope from there. Revoke or rotate affected tokens, isolate installed skills, review outbound connections, and inspect recent execution paths for payload staging or exfiltration. The response priority is to cut off inherited access before the compromised skill can keep using it.

Technical breakdown

Why marketplace skills behave like executable code

OpenClaw skills are not permission-scoped browser add-ons. According to the article, they execute as local code with access to the filesystem, environment variables, the network stack, and shell commands. That makes the marketplace a distributed execution platform, not just a catalog of extensions. The technical risk is that a skill can combine third-party logic with the same runtime authority as software installed directly on the host. In agentic environments, that collapses the usual separation between feature delivery and privileged execution.

Practical implication: treat skills as software deployments that require the same inventory, review, and execution controls as any other privileged code.

How malware moves through the skill layer

The article describes a common execution pattern in the ClawHavoc campaign: a seemingly benign skill hides a Base64-encoded payload, pipes it to bash, then retrieves further content from attacker-controlled infrastructure. Once executed, the script scans for tokens and credentials and exfiltrates data. This is a classic supply-chain delivery pattern adapted to AI extensions. The important architectural point is that the skill marketplace becomes the delivery mechanism, while the local runtime provides the trusted execution environment that the attacker needs.

Practical implication: inspect skill provenance and execution behaviour, not just descriptions, because the payload can live in the installable artefact itself.

OAuth over-provisioning and command injection in agent skills

The audit found that 70.1% of analyzed skills showed OAuth over-provisioning and 43.4% contained command injection patterns. Over-provisioning widens blast radius when a skill is compromised, because a single token may unlock more repositories, cloud services, or connected accounts than the task requires. Command injection compounds the problem by allowing user-controlled input to become shell execution. Together, those weaknesses turn ordinary extension logic into a path for credential exposure and arbitrary actions across the host environment.

Practical implication: minimise scopes and remove shell interpolation paths, because excessive privilege and command injection create the fastest route from extension to compromise.

Threat narrative

Attacker objective: The attacker’s objective is to use trusted marketplace distribution to gain local code execution, harvest credentials, and exfiltrate data through the victim’s own environment.

1. Entry occurs when a user installs a skill from the marketplace and grants it local execution authority under the assumption that it is a normal extension.
2. Credential access follows when the skill reads environment variables, token stores, or connected credentials and uses those values as part of its runtime behaviour.
3. Impact occurs when the payload fetches additional content, exfiltrates data to attacker-controlled infrastructure, or deploys credential-harvesting malware such as Atomic Stealer.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI extension marketplaces create an execution trust problem, not just a review problem: once a skill can run local code with host authority, the marketplace is no longer a distribution catalog, it is a privileged software supply chain. The article shows that naming, category placement, and popularity can stand in for actual trust validation. Practitioners should therefore treat installation authority as the real control boundary.

Over-provisioned scopes are the fastest path from feature enablement to blast-radius expansion: the article’s OAuth findings show that many skills ask for more access than their task needs. That is not a hygiene issue alone, it is a privilege design failure that makes compromise materially more damaging. Identity governance for agentic systems must assume that scope excess is the default attack amplifier.

OpenClaw demonstrates that arbitrary code execution plus credential access is enough to create systemic ecosystem risk: the risk is not limited to one malicious skill, because the marketplace architecture lets the same trust model reach many installs at once. When skills can execute, persist, and reach out to the network without meaningful isolation, the security boundary has already moved upstream to publication and onboarding.

Human review cannot compensate for machine-granted authority at install time: the article’s findings show that users install skills based on trust signals that are too thin for the power being granted. This is the governance gap that matters for agentic AI programmes: the control point is not user vigilance, it is pre-execution validation, permission scoping, and runtime containment.

Agent skill ecosystems need a new named control concept, skill execution blast radius: when a marketplace component can inherit local privileges, reach credentials, and make outbound connections, its impact is defined by what it can touch after installation. The practical consequence is that teams must evaluate extensions by execution reach, not by feature utility.

What this signals

Skill execution blast radius: agentic governance has to move from feature approval to execution containment. When third-party extensions can read credentials, write files, and call out to the network, the security decision is not whether the skill is useful, but how far its authority reaches after installation.

The OpenClaw findings also show why identity teams need to separate marketplace trust from runtime trust. A skill that looks harmless in a catalog can still behave like privileged software once installed, so lifecycle controls, permission scoping, and runtime isolation all need to cover the same object.

For agentic AI programmes, the operational question is whether the environment can survive a malicious or over-privileged skill without granting it durable access to tokens, shell execution, or sensitive data paths. If the answer is no, the onboarding process is too permissive.

For practitioners

• Inventory agent skills as executable software Classify every installed skill as a code-bearing component with local authority, then track where it was sourced, what it can execute, and which systems it can reach.
• Minimise OAuth scopes before installation Require task-specific scopes for every skill and reject broad grants that are not directly justified by the extension’s function.
• Isolate high-risk skills from sensitive environments Run marketplace skills in sandboxes or dedicated environments where filesystem, network, and credential access are constrained.
• Block shell execution paths in skill logic Review skills for command construction, dynamic subprocess calls, and encoded payload loaders before allowing them into production workflows.
• Rotate exposed credentials after skill compromise If a skill may have accessed environment variables or tokens, treat those secrets as potentially exposed and revoke them promptly.

Key takeaways

• OpenClaw skills are not lightweight extensions, because they execute as local code with access to credentials, files, and the network stack.
• The audit found both confirmed malware delivery and widespread insecure engineering, including over-provisioned OAuth scopes and command injection patterns.
• The key control failure is treating marketplace distribution as trust, when the real control boundary is execution authority and privilege containment.

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Marketplace Distribution: The process of publishing and installing third-party components through a shared catalog or registry. For AI skills, marketplace distribution matters because trust is often granted before execution is fully understood, which turns supply-chain controls into part of identity governance.
• Over-Provisioned OAuth: An OAuth grant that gives a component more access than its function requires. In AI skill ecosystems, over-provisioning widens blast radius when a skill is compromised, because the token can expose repositories, cloud services, or connected accounts beyond the task boundary.
• Skill Execution Blast Radius: The amount of damage a compromised skill can cause once installed. It reflects what the skill can reach after execution begins, including files, credentials, and network paths, and it is a better governance measure than feature usefulness in agentic environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.