Malicious Skills in OpenClaw Ecosystem Exploit AMOS Stealer and Exfiltrate Credentials
In February 2026, researchers identified a supply chain attack targeting users of OpenClaw, an open-source personal agent platform, through its third-party skill ecosystem. Malicious skills distributed via ClawHub, OpenClaw’s skill marketplace, were found to install the Atomic macOS Stealer (AMOS) malware and exfiltrate sensitive credentials, including private keys and API tokens. This incident marks the first documented case of malware distribution through an AI agent-skill marketplace, highlighting vulnerabilities in unvetted third-party integrations.
Many of these malicious skills were observed using slight name variations of legitimate utilities to evade detection. The malicious payloads were designed to execute obfuscated commands, fetch remote malware payloads, and, in some cases, deploy AMOS Stealer on macOS systems. Beyond credential theft, other skills were observed searching for and exfiltrating private keys, API tokens, and other sensitive data, posing significant risks to user privacy and security.
A broader audit conducted by Koi Security further revealed that out of 2,857 skills hosted on ClawHub, 341 were malicious. These skills were part of multiple coordinated campaigns aimed at spreading malware, including AMOS, keyloggers, and backdoors. The scale of the compromise underscores the challenges of manually reviewing scripts or commands in an ecosystem where malicious skills are deliberately designed to mimic legitimate utilities, making detection difficult without automated security measures.
The lack of vetting mechanisms in OpenClaw’s skill registry was a critical factor in this incident. Unlike traditional package registries, which often enforce code reviews or dependency checks, ClawHub did not implement comparable safeguards. This absence of oversight allowed malicious actors to distribute harmful skills undetected, exploiting the trust users place in third-party integrations to compromise their systems. The incident also revealed broader risks associated with open-source AI ecosystems, where the reliance on community-contributed tools can introduce unintended vulnerabilities.
Root Cause: Exploitation of Unvetted Third-Party Skills
OpenClaw’s design allows users to share and install third-party skills without verification, creating an environment where malicious actors could easily distribute harmful payloads. The researchers noted that many malicious skills were cloned with minor name changes, a tactic used to evade detection and blend in with legitimate offerings. This lack of oversight enabled the proliferation of skills designed to execute arbitrary commands, fetch remote malware, and steal sensitive data.
The malicious skills were engineered to appear benign, often posing as utilities such as system monitors, productivity tools, or automation scripts. Once installed, these skills would run obfuscated commands to download and execute additional payloads, including AMOS Stealer, which is specifically designed to target macOS systems. The stealer malware was capable of harvesting credentials, browser data, and other sensitive information, which was then exfiltrated to remote servers controlled by threat actors. Additionally, some skills were programmed to search for and extract private keys and API tokens, further expanding the scope of the compromise.
The scale of the compromise—with over 300 malicious skills identified—demonstrates how quickly such threats can spread in an unregulated environment. The lack of transparency in the skill submission process further complicated efforts to mitigate the risk, as users had no reliable way to verify the safety of the tools they installed.
Takeaways: Risks to AI Ecosystems and the Need for Security Measures
The compromise of OpenClaw’s skill marketplace demonstrates how malicious actors can exploit the trust placed in open-source platforms to distribute malware, steal credentials, and gain unauthorized access to user systems. The absence of security controls in ClawHub allowed threat actors to operate undetected, underscoring the need for proactive measures to prevent similar attacks in the future.
Traditional package registries often employ automated scans, dependency checks, and code reviews to identify and block malicious submissions. Adopting similar measures in AI agent ecosystems could significantly reduce the risk of supply chain attacks.
As AI systems become more interconnected, the risk of supply chain attacks will continue to grow. The OpenClaw incident is a reminder that even well-intentioned open-source projects can become vectors for malicious activity if proper security measures are not in place.
Sources
Incident summary from the AI Incident Database, used under CC BY-SA 4.0.