TL;DR: Cisco’s AI Defense team found nine vulnerabilities in OpenClaw’s top community skill, including two critical issues, and identified at least 230 malicious extensions in ClawHub since January 27, 2026, according to AuthMind. The deeper problem is that autonomous agents combine credential access, extensibility, and persistence in ways traditional IAM and IGA models were never built to observe or govern.
At a glance
What this is: OpenClaw’s malicious skills show how agentic AI extensibility can turn community code into a credential-exposing execution path with governance blind spots.
Why it matters: IAM, IGA, PAM, and NHI programmes need to account for autonomous agents that inherit user access, execute third-party skills, and leave identity tooling seeing only the initial authorization event.
By the numbers:
- At least 230 malicious OpenClaw extensions were uploaded to ClawHub since January 27, 2026.
Context
OpenClaw is an open-source agentic AI system that can connect to messaging, email, calendar, and developer tools, then act across those systems with user-granted access. The security issue is not simply that community skills can be malicious. The governance gap is that autonomous execution can combine trusted OAuth grants, local credential exposure, and third-party code into a single identity path that most IAM programmes do not observe.
The article’s central finding is that skill extensibility changes the risk model for agentic AI. Once an agent can install or run community skills that execute code, read environment variables, and make external calls, the security question becomes one of delegated authority, credential containment, and lifecycle control across a non-human execution layer.
That makes the topic directly relevant to NHI governance, autonomous-agent oversight, and identity observability. The starting position is not unusual for fast-moving agentic AI adoption: capability arrives before certification, inventory, and control design.
Key questions
Q: What breaks when an agent can install community skills with inherited access?
A: The failure mode is delegated execution without sufficient provenance control. A user may approve the agent once, but a later skill can inherit that access, run code, and alter the action path without a new governance decision. That breaks the assumption that authorization boundaries remain stable after consent.
Q: Why do AI agent skills create more risk than ordinary software packages?
A: AI agent skills inherit the permissions of the agent that runs them, so a malicious skill can act inside an existing trust boundary without needing to steal credentials first. That makes the effective blast radius depend on the agent's roles, tokens, and service connections, which is why skill governance must be tied to identity scope.
Q: How do security teams spot malicious activity after a legitimate login?
A: They correlate identity events across applications and look for behavioural deviation. Sudden file spikes, unusual locations, new device enrolments, broad OAuth grants, and access to data outside normal working patterns are stronger indicators than login success alone. Cross-application correlation is essential because single-system logs rarely reveal the full chain.
Q: When should organisations restrict autonomous agent access to enterprise systems?
A: They should tighten access when the agent can chain messaging, file, calendar, or developer permissions into broader action without human review. The more a skill can combine those systems, the more likely a static approval model will miss harmful behaviour that only appears after the initial grant.
Technical breakdown
How malicious agent skills turn trusted access into execution risk
OpenClaw skills are more than prompts. In the article, they can run code on the host, read environment variables, access local files, and make network calls. That makes the skill layer a delegated execution surface, not just a configuration layer. If the agent already has OAuth grants, bot tokens, or local credentials, the skill inherits the available reach and can chain those permissions into data movement or command execution without another authorization decision. The issue is not only malicious code. It is the combination of extensibility, privilege inheritance, and runtime execution in a single agent session.
Practical implication: Treat third-party agent skills as executable identity-bearing components, not harmless extensions.
Why identity observability fails after authentication succeeds
Traditional IAM and IGA tools are good at recording that a user authenticated and received access. They are much weaker at showing what an autonomous agent did with that access after the grant succeeded. In this case, the logs may show a legitimate OAuth approval, but not that a community skill used the token to exfiltrate data or access resources in a pattern inconsistent with the user’s normal behaviour. That gap matters because agentic AI shifts the risk from authentication events to post-authentication action chains. Observability has to follow the credential into runtime use, not stop at issuance.
Practical implication: Correlate token use, external calls, and action sequence, not just login and consent events.
Why supply chain controls now belong in agent identity governance
The ClawHub findings show a supply chain problem with identity consequences. Community skills can be ranked, downloaded, modified, and reused quickly, which creates a path for malicious code to spread inside trusted agent workflows. The article also shows how ranking manipulation and rebrands can help malicious components look legitimate. For IAM and NHI teams, that means provenance, certification, and revocation matter at the skill layer just as they do for secrets and service accounts. Agentic AI expands the supply chain to include the instructions and code that shape runtime behaviour.
Practical implication: Add provenance checks and approval gates before community agent skills can inherit production access.
Threat narrative
Attacker objective: The attacker aims to harvest credentials and exfiltrate data through a trusted agent workflow while avoiding obvious user-facing alarms.
- Entry occurs when a user installs a community skill into an agentic AI platform and grants the agent legitimate OAuth, token, or filesystem access.
- Credential access happens when the skill can read environment variables, local files, or inherited tokens and then use those secrets as part of its execution.
- Escalation follows when the skill combines prompt injection, external calls, and host execution to move data out of the trusted boundary under valid permissions.
- Impact is data exfiltration and unauthorized action performed through an apparently authorized agent workflow, leaving conventional logs to show only the original consent event.
Breaches seen in the wild
- Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
- Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic AI turns community extensibility into an identity control plane. Once a skill can execute code, read environment variables, and make network calls, the governance question is no longer only whether the agent is authenticated. The issue becomes whether the agent’s delegated authority is bounded at the moment the skill runs. Identity teams need to treat the skill layer as part of the identity surface, not a separate software convenience layer.
Credential visibility without post-authentication context is no longer enough. IAM and IGA models were designed to confirm access grant and periodic review, but autonomous agents can consume credentials between those checkpoints. That means certification proves very little if runtime use can diverge immediately from the authorized intent. The field needs identity observability that tracks action chains, not just standing grants.
Uncertified agent skills create ephemeral trust debt. The article shows how quickly popularity, distribution, and trust can outrun review when agents accept community code. That is a named concept worth tracking because the exposure window is created by rapid installation plus delegated access plus weak provenance. Practitioners should recognise that skill trust is now a lifecycle problem, not just a download problem.
Least privilege becomes operationally ambiguous when the actor is autonomous. The platform’s value comes from letting the agent do meaningful work across messaging, calendar, files, and development tools. That means least privilege cannot be reduced to a static pre-approval list without stripping away the use case. Security teams therefore need to reframe authorisation around runtime intent, scoped delegation, and revocation of the downstream components that inherit access.
Supply chain governance must extend to agent behaviour, not just package integrity. A benign-looking skill can still alter the agent’s decisions, request sequence, and exfiltration path after installation. The implication is that identity governance now has to cover provenance, runtime permissions, and behavioural drift across non-human actors. The next control boundary is the action path itself.
From our research library:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Maturity Model
What this signals
Ephemeral trust debt: agent skills create a short but dangerous interval in which a community component can inherit broad access before provenance, behaviour, and revocation controls catch up. That matters because the real risk is not just installation, but the time between installation and meaningful governance.
The OpenClaw pattern shows why identity programmes need to watch runtime action sequences, not only authentication success. An approved token can still be abused by a skill that redirects data, invokes external services, or changes the sequence of actions inside a trusted session.
Only 13% of organisations feel extremely prepared for the reality of agentic AI, according to the 2026 Infrastructure Identity Survey. The gap is not awareness alone. It is the lack of controls that can observe and limit what an autonomous actor does after credentials are already in play.
For practitioners
- Map the agent skill surface Inventory where community skills, custom prompts, or plug-in components can execute with inherited credentials or host access. Focus on systems where users can connect email, messaging, calendar, or developer accounts, because those are the points where autonomous behaviour becomes identity risk.
- Separate approval from runtime privilege Require explicit scoping for what a skill can read, write, or invoke after installation. Do not assume that a user’s initial consent is sufficient to justify continuous access to files, tokens, or external services.
- Instrument post-authentication behaviour Track which credentials are used, by which agent, against which systems, and what network destinations follow. That is the only way to distinguish a legitimate consent event from an agent-led exfiltration path.
- Add provenance controls for community skills Treat ranking, popularity, and repository visibility as non-controls. Put code signing, review, and revocation rules in front of any skill that can inherit enterprise access.
- Constrain access to local credential stores Reduce the chance that environment variables, .env files, and cached tokens become available to agent runtimes on developer endpoints or personal devices.
Key takeaways
- OpenClaw’s malicious skills show that agentic AI risk starts at the skill layer, where trusted code can inherit user authority and alter runtime behaviour.
- The article’s evidence is concrete: nine vulnerabilities in the most popular community skill and at least 230 malicious extensions in ClawHub since late January 2026.
- Identity teams need controls that follow credential use after authorization, because post-login action chains are where autonomous abuse becomes visible.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Malicious skills misuse the agent’s tools and inherited permissions. |
| ASI04 — Agentic Supply Chain Vulnerabilities | The article centres on community skills as a supply chain risk for agentic systems. | |
| ASI03 — Identity & Privilege Abuse | The attack works by inheriting user-granted access and using it beyond expected intent. | |
| Recommendation — Map untrusted skill behaviour to ASI02 and restrict which tools a skill can invoke at runtime. Apply ASI04 controls to review, sign, and revoke agent skills before they inherit access. Limit delegated privileges under ASI03 so agents cannot reuse broad human credentials unchecked. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Third-party community skills behave like externally supplied non-human identities in the trust chain. |
| NHI-05 — Overprivileged NHI | Agents inherit broad tokens and file access that exceed the minimum needed for the task. | |
| NHI-10 — Human Use of NHI | Users install skills and authorize access, then the agent acts on that human-granted identity. | |
| Recommendation — Treat third-party skills as NHI dependencies and block production access until they are reviewed. Reduce agent privilege scope under NHI-05 so inherited access cannot reach unrelated systems. Separate human consent from machine use under NHI-10 so agent actions cannot outlive the original approval. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The skill chain combines credential exposure with data exfiltration through trusted execution. |
| Recommendation — Map the pattern to TA0006 and TA0010 and hunt for token theft followed by outbound data transfer. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is an authorization boundary that remains too broad after the agent starts running. |
| Recommendation — Apply PR.AA-05 to constrain agent permissions to the smallest runtime scope possible. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Identity Observability: Identity observability is a continuous governance approach that correlates identity activity with business context, telemetry, and policy state. Instead of checking access at a single point in time, it tracks what an identity can do, what it did, and why that action matters to the business.
- Delegation authority: Delegation authority is the right for one identity to act on behalf of another within a defined scope. For agents, it must be explicit, time-bound, and auditable because the system may initiate actions independently once granted access.
- Ephemeral trust debt: Ephemeral trust debt is the accumulated risk created when short-lived access, credentials, or trust relationships are issued quickly and not fully governed. In practice, it appears when temporary permissions, tokens, or sessions outlive their intended purpose, lack clear ownership, or are not revoked, audited, or rotated with enough discipline.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org