Notifications
Clear all
Topic starter
21/08/2026 4:49 pm
TL;DR: A trojanized OpenClaw marketplace skill disguises itself as a reminder utility while silently installing a second package to collect API keys and .env files, base64-encode them, and exfiltrate them through a public dead-drop channel, according to ActiveFence. The case shows how emerging AI skill ecosystems can turn trusted packages into a credential theft path when runtime behaviour is not inspected before execution.
NHIMG editorial — based on content published by ActiveFence: We Audited the OpenClaw Marketplace. We Found a Trojan
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when an AI skill can install hidden dependencies after approval?
A: The approval model breaks because users think they are authorising one package, but the runtime can pull in a second payload with different behaviour.
Q: Why do AI-assisted development workflows increase secret exposure risk?
A: They increase exposure because developers move faster, paste more context into prompts, and review output for function before security.
Q: How do organisations know if an AI marketplace package is behaving maliciously?
A: Look for mismatches between declared function and observed runtime behaviour.
Practitioner guidance
- Inspect skill initialisation paths before first execution Review SKILL.md, installer scripts, and any post-install hooks for hidden dependency downloads, silent flags, or secondary package execution.
- Monitor agent runtimes for secret file access Alert on reads of .env, .mykey, token stores, and workspace memory paths from AI skill processes, especially when followed by Base64 encoding or outbound POST requests.
- Restrict outbound destinations from AI workflows Apply allowlisting and egress validation so skills and agents cannot post to arbitrary public endpoints or dead-drop services.
What's in the full report
ActiveFence's full blog covers the operational detail this post intentionally leaves for the source:
- The full malicious package structure and initialisation logic that enabled the hidden second-stage install.
- The proof-of-concept chain showing how secrets were encoded and sent to the dead-drop endpoint.
- The canary test method used to validate that the exfiltration path was active.
- The specific file paths and script behaviour that made the trojan hard to spot during review.
👉 Read ActiveFence's analysis of the trojanized OpenClaw marketplace skill →
Trojanized AI skills: what practitioners need to do now?
Explore further
21/08/2026 5:07 pm
Trojanised AI skills are becoming an NHI governance problem, not just a supply-chain problem. A skill that can install dependencies, read files, and schedule background work is operating as a non-human execution identity. That means its permissions, trust boundary, and revocation path need the same lifecycle thinking applied to service accounts and automation accounts. The governance failure is assuming a marketplace package is only software when it can actually act like a privileged runtime principal.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records including chat histories, backend credentials, and API keys, according to the same report.
A question worth separating out:
Q: What should teams do when an AI skill touches credentials or .env files?
A: Treat it as a credential-handling workload and apply containment immediately. Restrict file access, inspect process egress, rotate any exposed secrets, and review whether the skill can persist across restarts or schedule background activity. The key is to limit blast radius before the workflow can reuse the stolen data.
👉 Read our full editorial: Trojanized AI skills expose a supply-chain path to credential theft
