Topic starter
05/07/2026 6:48 pm
TL;DR: Among 4,310 OpenClaw skills audited and 221 analyzed in depth, 44 were tied to the ClawHavoc malware campaign, 70.1% showed OAuth over-provisioning, and 43.4% exhibited command injection patterns, according to Lakera. Agent skills are not lightweight plugins; they are executable code with marketplace distribution and host-level authority.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “The Agent Skill Ecosystem: When AI Extensions Become a Malware Delivery Channel (OpenClaw Hackathon Findings)”.
Key questions
Q: What breaks when AI serving engines run with excessive privileges?
A: Excess privilege lets a compromised inference service reach host resources, GPU drivers, local files, or internal networks that should be off limits.
Q: Why do over-provisioned OAuth scopes make agent skills more dangerous?
A: Because the token becomes a blast-radius multiplier.
Q: How can security teams tell when a skill marketplace is failing governance controls?
A: Look for symptoms such as broad default permissions, opaque external endpoints, shell invocation inside skill code, and no mandatory review before publication.
Practitioner guidance
- Inventory agent skills as executable software Classify every installed skill as a code-bearing component with local authority, then track where it was sourced, what it can execute, and which systems it can reach.
- Minimise OAuth scopes before installation Require task-specific scopes for every skill and reject broad grants that are not directly justified by the extension’s function.
- Isolate high-risk skills from sensitive environments Run marketplace skills in sandboxes or dedicated environments where filesystem, network, and credential access are constrained.
Bottom line: OpenClaw skills are not lightweight extensions, because they execute as local code with access to credentials, files, and the network stack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:06 pm
AI extension marketplaces create an execution trust problem, not just a review problem: once a skill can run local code with host authority, the marketplace is no longer a distribution catalog, it is a privileged software supply chain. The article shows that naming, category placement, and popularity can stand in for actual trust validation. Practitioners should therefore treat installation authority as the real control boundary.
A question worth separating out:
Q: How should organisations respond when a skill may have exposed secrets or run malware?
A: Assume credential compromise first, then verify scope from there. Revoke or rotate affected tokens, isolate installed skills, review outbound connections, and inspect recent execution paths for payload staging or exfiltration. The response priority is to cut off inherited access before the compromised skill can keep using it.
👉 Read our full editorial: OpenClaw skills show how AI extensions become malware channels