OpenClaw skills: installation, creation, and protection against 341 malicious sets

The author of a material on Habr published a breakdown of the skills system in OpenClaw after checking 2857 skills revealed 341 malicious ones — and, as emphasized in the article, these are only the cases that were found. The publication explains that skills in OpenClaw — are not passive content and not ordinary plugins, but instructions by which an autonomous agent reads files, runs commands and accesses the network, that is, effectively receives privileged access to the user's system.

Why OpenClaw skills are not just plugins

• Skills checked — 2857
• Malicious identified — 341
• Source of risk — ClawHub platform, where users install third-party skills
• Nature of skill — not content, but instructions giving the agent access to files, commands and network
• Consequence of failed installation — execution of a stranger's code in the agent's privileged environment

It is explained that architecturally, a skill in OpenClaw is a set of instructions that the agent interprets and executes with the same rights that the agent has in the system: file reading and writing, running shell commands, making network requests. Unlike a classic plugin, which is usually limited to a strictly defined API and sandbox, a skill can use any capabilities available to the agent as a whole — and since modern autonomous agents often work with broad rights for the sake of user convenience, this difference turns out to be fundamental. This is precisely why a single failed skill installation from the open ClawHub catalog is equivalent to giving a stranger to whose instructions you will entrust the execution of code in a privileged environment — with the same consequences as running an unchecked script as a user on his own machine.

How the priority system works and why order matters?

The material analyzes where skills are stored, how to create them independently, and why the order of priority between several installed skills matters more than it might seem at first glance: if two skills offer conflicting or overlapping instructions, then depending on which one the agent applies first, the behavior of the system can differ radically — including situations where a later, malicious skill is able to redefine safe instructions established earlier, and thus imperceptibly to the user change the logic of the entire agent's work.

What to do to not turn convenience into an incident

The author formulates practical recommendations for protection: carefully check the source of the skill before installing, give preference to skills with open and verifiable code of instructions, limit the rights of the agent itself where possible, and understand that a catalog like ClawHub, for all its usefulness for quick expansion of agent capabilities, is by its nature such a vector of attack as any other public third-party code repository — with the difference that a compromised skill gets access not to an isolated container, but directly to the agent's working environment and, often, to user data and credentials, which makes the price of error in choosing a skill significantly higher than when installing an ordinary third-party package.

A separate place in the material is occupied by a breakdown of how to write your own, secure skills: the author advises to explicitly limit in the skill description the range of actions it should perform, avoid overly broad formulations like "do everything necessary" and document which files, commands and network addresses the skill uses legitimately — so that during an audit or suspicion of conflict with another skill, you can quickly understand what behavior is expected and what signals a compromise.

The figure of 341 malicious skills out of 2857 checked, which the author cites, is important not in itself, but as an indicator of scale: this is data on only found cases, which means the actual proportion of compromised or overtly malicious skills on the platform may be higher. For the community of OpenClaw users, this means that relying solely on the fact that a skill is published in the ClawHub catalog as confirmation of its safety cannot be done — platform moderation reduces risk but does not eliminate it completely, and final responsibility for verification of the installed skill remains with the user himself.