TL;DR: A trojanized OpenClaw marketplace skill disguises itself as a reminder utility while silently installing a second package to collect API keys and .env files, base64-encode them, and exfiltrate them through a public dead-drop channel, according to ActiveFence. The case shows how emerging AI skill ecosystems can turn trusted packages into a credential theft path when runtime behaviour is not inspected before execution.
At a glance
What this is: ActiveFence’s analysis shows a trojanized OpenClaw skill using a marketplace distribution path to install a secondary payload that steals credentials and silently exfiltrates them.
Why it matters: It matters because AI skill and agent ecosystems can convert trusted distribution channels into hidden credential-exposure paths, forcing security teams to govern what executes, not just what is published.
Context
An AI skill marketplace becomes a security boundary the moment published code can run with access to files, tokens, or workspace state. In that model, the main control problem is not just package approval, but whether the runtime behaviour matches the declared purpose after installation.
This article sits at the intersection of agentic AI security and supply-chain risk. The identity angle is genuine because the payload harvests secrets and API keys, which turns ordinary software trust into non-human identity exposure, persistence, and exfiltration risk.
Key questions
Q: What breaks when an AI skill can install hidden dependencies after approval?
A: The approval model breaks because users think they are authorising one package, but the runtime can pull in a second payload with different behaviour. That creates an invisible trust expansion. Security teams should require post-install inspection, dependency provenance checks, and runtime containment for any skill that can modify its own execution path.
Q: Why do trojanized AI skills create supply-chain risk for credentials?
A: They turn a trusted distribution channel into a secret-harvesting path. Once a skill can enumerate workspace files, read .env content, and send data out through an external service, the attack no longer depends on a classic exploit. The risk comes from delegated execution in a place where machine secrets already exist.
Q: What are the signs that shadow AI is leaking secrets?
A: Look for prompts containing API keys, tokens, connection strings, customer data, or regulated information, especially when the same workstation also runs local models or AI plugins. Repeated copy-and-paste into AI tools is a strong indicator that secret handling has escaped normal controls.
Q: How should security teams govern marketplace skills that can reach local files?
A: Apply a least-privilege model to skill execution, then add process and network monitoring that is specific to AI runtimes. The goal is to stop a skill from reading credential files or launching hidden dependencies unless that access has been explicitly justified and constrained by policy.
Technical breakdown
How trojanized AI skills hide in plain sight
A trojanized skill is a package that appears to deliver one function while embedding a second, malicious function in its installation or startup path. In agent ecosystems, the danger is not limited to code that looks suspicious in isolation. The package can present a harmless description, use a minimal file structure, and defer malicious behaviour into initialisation files, hooks, or dependent modules. That means static review of the headline description or file names is not enough. Practitioners need to understand where execution begins, what permissions the skill inherits, and whether the package can reach workspace files, network destinations, or other installed components.
Practical implication: Treat marketplace approval as an execution-risk decision, not a catalog-review exercise.
Why secondary payloads change the supply-chain model
A secondary payload turns a single marketplace install into a multi-stage compromise. The first package earns trust by offering a legitimate front-end function, then quietly installs or activates another component that performs credential discovery, packaging, and exfiltration. That pattern is especially dangerous in AI ecosystems because the skill boundary often overlaps with local files, memory, and agent context. Once the second payload is present, the attacker no longer needs an obvious exploit chain. They only need the environment to allow the skill to read secrets, make outbound requests, and persist across sessions or restarts.
Practical implication: Inventory and vet dependency chains, not just the top-level skill artifact.
How dead-drop exfiltration evades ordinary review
Dead-drop exfiltration sends stolen data to a public or semi-public service that looks operationally normal, which reduces the chance of simple destination-based blocking. Encoding secrets before transmission further obscures what is being moved, and quiet error handling removes obvious alerts. In this case, the exfiltration channel blended into a legitimate notification service, which means network defenders may see harmless-looking traffic unless they inspect the payload, topic, and process lineage. For identity teams, the lesson is direct: the risk is not only that a secret exists, but that a non-human workload can silently package and export it without a human approval step.
Practical implication: Monitor outbound behaviour and payload content, not just destination reputation.
Threat narrative
Attacker objective: Steal secrets and environment credentials from AI-enabled workspaces while hiding activity inside legitimate marketplace and notification traffic.
- Entry occurred through a trojanized OpenClaw marketplace skill that presented itself as a reminder utility while embedding malicious initialization logic.
- The initial skill installed a secondary payload that searched for .mykey and .env files, then base64-encoded their contents for transfer.
- The payload exfiltrated the harvested secrets to a public ntfy.sh dead-drop channel with output suppressed to avoid visible alerts.
- The attacker’s objective was to steal API keys and credential files from OpenClaw environments without triggering user suspicion.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Trojanized skill ecosystems create a governance problem, not just a malware problem. Once a skill can install a second payload and read workspace secrets, the issue moves from package trust to runtime authority. That is especially true in agentic environments where execution may be triggered by a user action but continue invisibly in the background. Practitioners should treat skill execution rights as a governed identity boundary, not a convenience feature.
Secret exposure in AI workspaces is now an NHI lifecycle issue. The stolen material here is not a password vault dump, but the operational residue of machine use, including API keys and .env files. That means discovery, storage, and revocation need to be managed as non-human identity controls, not only as application hygiene. The named concept is skill-chain credential exposure, where a trusted AI skill becomes the path from execution to credential theft.
Marketplace trust without behaviour inspection is a failed assumption. Review processes that focus on package description, publisher identity, or file count miss the actual control point, which is what the skill does after installation. This is the same failure mode that appears across supply-chain abuse: trust in the wrapper substitutes for control over the runtime. Security teams should assume that published metadata cannot prove benign behaviour.
Public dead-drop services collapse the difference between normal SaaS use and exfiltration. When stolen credentials are posted to a legitimate service endpoint, destination-based allowlists lose much of their value. The operational question becomes whether the environment can recognise abusive payload patterns, not whether the URL looks suspicious. For identity security programmes, that means outbound controls must be paired with secret-detection and process-aware monitoring.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Skill-chain credential exposure: AI skill ecosystems now need control boundaries that assume a published skill can become a credential-stealing runtime after install. That changes the job of governance from approving artifacts to verifying post-install behaviour, especially where workspace secrets and API keys are reachable.
The practical programme shift is toward runtime observability for skills, file access controls around secret-bearing paths, and egress monitoring for public dead-drop services. Organisations that treat marketplace trust as sufficient will keep missing the moment where benign description turns into malicious execution.
The exposure is not hypothetical. According to the Ultimate Guide to NHIs, 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
For practitioners
- Inspect skill installation paths for hidden dependency pulls Review marketplace skills for secondary installs, nested packages, or startup hooks that can introduce unapproved code after the initial approval step.
- Block access to high-risk secret file locations Constrain AI workloads so they cannot freely enumerate .env files, workspace memory, or other secret-bearing paths unless a specific task requires it.
- Detect outbound exfiltration to public dead-drop services Alert on encoded payloads, unusual POSTs, and repeat use of public notification or paste services from AI runtime processes.
- Separate marketplace trust from runtime trust Require a second control layer that observes what a skill does after install, including file access, process creation, and network activity.
- Treat API keys in workspaces as revocable machine secrets Assume any credential present in AI workspaces can be read by code, then shorten lifetime and rotate on exposure signals.
Key takeaways
- This case shows that an AI skill marketplace can be used to distribute a trojanised package that turns ordinary installation trust into secret theft.
- The core weakness is runtime invisibility. Once a skill can install a second payload, read workspace files, and exfiltrate them quietly, static review of the published package is not enough.
- Security teams need controls that govern what a skill can execute, what files it can touch, and where it can send data after installation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | The malicious skill arrived through a marketplace dependency path, which is a third-party NHI distribution risk. |
| NHI-02 — Secret Leakage | The payload steals API keys and .env files, making secret leakage the central harm. | |
| NHI-07 — Long-Lived Secrets | The article shows how long-lived workspace credentials remain stealable once a skill can read them. | |
| Recommendation — Vet third-party skills as untrusted machine identities before allowing them into production runtimes. Scan skill runtimes for secret access and revoke any exposed keys immediately. Shorten machine secret lifetime and rotate credentials that are stored in AI workspaces. | ||
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The skill misuses its ability to access files and network tools for silent exfiltration. |
| Recommendation — Restrict agent tools so file reads and network calls are denied unless explicitly required. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The chain combines credential harvesting with covert outbound transfer. |
| Recommendation — Map the behaviour to credential access and exfiltration tactics when tuning detections and response playbooks. | ||
Key terms
- Trojanised AI Skill: A trojanised AI skill is a package that presents legitimate functionality while embedding hidden malicious behaviour. In practice, it can install secondary payloads, read sensitive files, or alter runtime behaviour after approval, making it both a software supply-chain risk and an identity governance problem.
- Dead-Drop Exfiltration: Dead-drop exfiltration is the use of a public or semi-public service as a covert place to receive stolen data. It reduces the need for a dedicated attacker server and can blend malicious traffic into legitimate-looking platform usage, making detection harder unless payloads and process context are inspected.
- Skill-Chain Credential Exposure: Skill-chain credential exposure is the risk that a trusted AI skill becomes the path from installation to secret theft. The chain often includes file discovery, secret collection, encoding, and outbound transfer, which means governance has to cover both approval and what happens after execution starts.
- Runtime Behaviour Monitoring: Runtime behaviour monitoring is the practice of watching what an identity actually does during execution, not just what it was configured to do. For AI agents, this means tracking tool calls, session activity, data volume, and unusual action sequences so semantic abuse can be detected in flight.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the realities of agentic AI and machine-driven access.
Published by the NHIMG editorial team on August 21, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org