The OpenClaw Security Crisis Nobody Is Talking About

0:00We need to talk about something that is very concerning for people who are running Open Claw. A security researcher just scanned all 31,000 skills on ClawHub and the main skill registry for Open Claw and found that 2,371 of them are straight-up dangerous. We're talking crypto wallet theft, credential stealing, reverse shells, and the whole thing. And I'm going to break it all down on what is exactly happening and what it means for you and how to protect yourself. Because if you're installing skills without checking them first, you absolutely need to hear this. So, I'm going to back up a little bit and pump the brake. If you're new to the channel, my name is Beau. I run a 13 AI agent setup here on the Mac mini that handles

0:46my entire business and content pipeline. I've been building with Open Claw for the last 45 days and I run a community called Shipping School where we help 161 people ship real products with AI. And one of those things I've always said in our community is that you need to be careful on what you install. I have a rule. VirusTotal must say benign before any skill gets even looked at. No exceptions. And honestly, I don't even download the skills. I just grab the link, give it to my AI agent, and say recreate this skill for me. And that's it. And this story right here is exactly why I have that rule. I don't want to take the chance. So, here's what happened. A security researcher posted on the cybersecurity Reddit. I have a link down below, by the way, you need to check it out, which has like a 1.4

1:33million subscribers, massive community of security professionals. And this person didn't just complain about security. They actually built something about it. And they created a static analysis scanner, basically a tool that reads through every single skill published on ClawHub, and it looks for patterns that match known attack techniques. And then they ran it against all 31,000 plus skills in the registry, every single one of them. And what they found is pretty scary. 7.6% of all skills were flagged as malicious. That's about 2,300 skills. So, let me put that into perspective for you. If you go to ClawHub right now and install 10 random skills, statistically one of them could be stealing your data. Not good. So, that's a rounding error and

2:18that's not some edge case. That's a real problem. And this isn't even the first time we've heard about this. Back in February, a security firm called Koi Security did a smaller audit and found 341 malicious skills across 2,800 that they checked. The Hacker News covered it. That was already concerning. Then by mid-February, another company called Concealia tracked up to 824 malicious skills across 10,000. They traced 335 of those back to a single coordinator operation they called ClawHaveIt. One operation with 335 malicious skills. But here's the main thing. The registry has been growing at an insane rate. It went

3:04from 10,000 to over 31,000 in just 1 month. And the bad actors are growing right alongside it. The more the ecosystem grows, the more attack surface there is. Real quick, before we keep going, if you're watching this and you want to actually build with some of these tools, not just watch videos about them, then you're going to want to check out our community down below, Shipping School. We have a full Claude code course, a full Open Claw course, and four live bootcamps every single week where we actually help you get set up from scratch. Like actually set this thing up, not just watch a tutorial and figure it out by yourself. And we also provide one-on-one coaching, so you could book a call with me, we could share screens, and I can help you get Claude code or Open Claw running on your

3:49machine. That's it, no fluff. I built this community because watching YouTube's only gets you so far. We launched it just 3 days ago and we have over 55 members. You need people around you who are actually building, people who hold you accountable, and coaches who can help you when you get stuck. I'll put the link in the description down below. Get in now before the price goes up. So, what are these malicious skills actually doing to people? I want to talk about this in not to scare you, just to bring awareness. If you've downloaded skills from ClawHub before, and you need to understand understand this even if you're not super technical. The first category is a crypto wallet theft skill that, you know, that are disguised as crypto trading tools or wallet automation. You install them thinking they're going to help you

4:34manage your portfolio or automate some trades, but behind the scenes they're actually grabbing your private keys and selling them to someone else's server. Nah, Tom's Hardware covered this uh specific campaign, malicious skills targeting crypto users on ClawHub. That's your money, gone. And you wouldn't even know it until you check your wallet and it's empty. The second category is credential exfiltration. So, these skills are designed to find and steal your API keys, your tokens, your passwords. Now, when you think about what your Open Claw agent has access to, if you're running a setup like mine, you've got database credentials, email passwords, social media tokens, payment processing keys, YouTube API keys, all of it sitting in, you know, like environment variable files. So, if the

5:19malicious skill grabs those, someone has access to your entire digital life. They could post on your social media, they could access your database, they could drain your payment accounts. The third category is reverse shells, and this is where it gets really technical and more scary. Like I said, I'm not trying to put fear into you, I'm just trying to bring awareness. A reverse shell means someone could remotely control your computer through the skill you installed. They're literally inside your machine. They can see your files, they can run commands, install more malware, you know, like BonziBuddy, move laterally through your network, and you would never know it's happening because from your end it looks like a normal Open Claw skill running in the background doing its thing. The fourth category is base64 encoded payloads. This is really sneaky technique where the malicious code is encoded so it

6:05doesn't look like a dangerous skill on the surface. You read the skill markdown file, everything looks pretty normal, clean descriptions, reasonable permissions, and it looks legit. But hidden inside is encoded instructions that decode and execute when the skill runs. It's like a Trojan horse. The gates look friendly, but there's an army hiding inside. And here's the thing that really got me. Snyk, which is one of the biggest security companies in the developer space, published a report with the title that gave me chills, from skill markdown to shell access in three lines of a markdown. Three lines, y'all. That's all it takes for a bad skill to go from looking innocent to having full access to your computer. Three lines of a markdown in a skill file can give someone shell access to your machine.

6:50So, when I read that, I was pulling my hair out thinking about all the skills people are casually installing every day. Now, you might be thinking, well, the ClawHub team should just remove the bad skills. Sounds easy. And yeah, they obviously should, but here's the problem. The researchers' scanners rescan every 6 hours and new malicious skills keep showing up. The registry is growing super fast and faster than anyone can manually review. It's the same problem that every app store has ever faced. Apple deals with it, Google deals with it, NPM deals with it, but the stakes are high here and they're fundamentally different. Open Claw skills aren't sandbox apps running on your phone with limited permissions. This is code running directly in your computer with access to your files, your network, your environment variables, everything. Now, here's where I want to

7:36connect this to my own experience because I think it's super important. When we first started building our agent pipeline, I was excited about skills. Like a kid in a candy store, ClawHub had thousands of the skills. You know, you need a weather skill or whatever, there's one for that. You need a YouTube analytics skill, it's there. Need a posting skill, done. And I'll be honest, I was wanting to install them left and right without thinking too hard about it. Then I really stopped and thought, who is making these skills? And what do I know about these skills? I don't know. Every skill, you know, that I would think about installing would get access to my whole computer and inside my workspace and inside all my environment variable files and database credentials, API keys, and all that. You know, if I installed one bad skill, just one, someone could drain all the accounts and

8:22post garbage on social media and access customers' data in Shipping School, you know, the whole thing. The entire operation would be compromised. So, I implemented the VirusTotal rule as well as the rule of not installing a skill unless it has a benign rule and you give that URL to your agent to be able to recreate that skill. So, I would never personally install a skill, I would make sure it's safe first and then give the URL of the skill to my agent to just create the same thing for me. So, you don't want to take place any exceptions here. You you don't want the risk. Your LLM that you use, especially if you're using Claude models, can recreate that skill, no problem. And I want to share with you what I actually do to stay safe because this is practical stuff that you

9:07can start doing today. You know, you always want to read the skill markdown file before you even look at a skill, like actually read it and take the time. Look for anything that might seem off. Does it reference external URLs you don't recognize? Or does it try to download additional scripts at runtime? Does it ask for permissions it doesn't need? You know, weather skill that shouldn't need access to your file system. That's a huge red flag. The second thing I would do is check the source, like who published the skill? Do they have a GitHub profile you could verify? Is there a history of contributions? Are there other people using it and vouching for it? Or did it just show up yesterday with zero stars and no history? If that's the case, don't even look at it. The VirusTotal rule is the third one. Just make sure it's benign and you read the skill markdown file. I'm dead serious about

9:52this. Don't install them. Run the skill files through the scanner and then have your agent recreate it. You know, the fifth one, and and this could save you from a nightmare that takes weeks to recover from, is, you know, consider running your Open Claw instance with proper sandboxing. Nemo Claw from Nvidia was built for that. It creates a sandbox environment where skills can't access your main system directly. It is more setup work, but it is worth it if you're actually running a business on top of Open Claw. The next thing would be keep your trust scores in mind. The researcher found the average trust score across the entire Claw Hub registry is 93 out of 100. So, the majority of skills are fine. Most developers are publishing skills are good people, you know, trying to help. But, the 7 8% that aren't fine, those are the ones that are going to ruin your day. And 8% is a

10:38little higher than most people expected. If you're struggling to keep up with content, well, I'm about to save you about 40 days worth of work. I built [music] something called Content Machine. It's 10 AI agents that run on the Open Claw orchestration, and they handle everything. Scripts, thumbnails, X posts, blogs, outreach, clips, [music] newsletters, all of it. So, I went from 1,000 subscribers to 4,000 subscribers on YouTube in 7 days using this exact system. Every single morning, I wake up, and the content's already done. I spend maybe 15, 20 minutes reviewing and approving them, and I move on with my day. It works for any niche, fitness, [music] finance, real estate, marketing, whatever you are building, and it is

11:23100% completely customizable to your use case. So, you get the mission control dashboard, all of the cron jobs, everything I've built over the last 40 days helping me gain more and more people to subscribe [music] and join the community. So, you plug in your own thing, and it molds it to you. It learns how you talk, and it writes, so it doesn't sound like AI slop. $97 one time, it's not a subscription. I'll put the link down below, and you'll thank me later. You know, this connects to much bigger conversation about the entire AI agent ecosystem. Dark Reading, which is one of the major cybersecurity publications, published an article with a title that says it all. Open Claw AI runs wild in business environments. And they made a point that I think everyone needs to hear. Agent ecosystems change

12:10the supply chain risk equation completely. Skills aren't just code libraries. They become operational components that access files, credentials, APIs, and business data. When malicious skills get through a public registry, the blast radius includes credential theft, lateral movement through connected services, and complete compromise of developer workstations. When I think about this in terms of our community that we've built, we have people inside of Shipping School who are building their first AI agent systems right now. And they're excited. They're installing skills, they're following tutorials, and I don't want any of them to get burned because they just didn't know about this risk. That's why I'm making this video, for people that are just getting started. Place the proper security measures in mind when

12:55you're getting things built out. The truth is, the Open Claw ecosystem is growing at the insane pace. You know, 31,000 skills from 10,000 skills in less than a month, and it's climbing every single day. That growth is incredible, and that's what makes Open Claw so powerful. But, with that growth comes responsibility, both on the platform side to implement better security scanning, and on our side as users to be smart about what we install and how we verify it. I actually think this is one of the most important things about running your own AI setup versus using some managed cloud service. When you run it yourself, you're in control. You know, you own your own data. You own your configuration. You own your own destiny. But, that also means you're responsible for your own security. It's the number one thing that I say when people get set up. Make sure your security is dialed in. Nobody else is

13:40going to check those skills for you. Nobody else is going to protect your credentials. That's on you. But, that's okay. That's the trade-off. You just have to take it seriously. So, if you're watching this, and you've been installing skills without checking them, I don't want you to freak out. I'm not trying to scare you. But, I am just trying to wake people up. You know, go through your installed skills today. Check what you've got running. Make sure you know where each one came from and what it does. Remove anything you can't verify. And from now on, copy the URL of the skill that you like, and give it to your agent, and have it recreate it for you. That is no risk. You know, if you're building with AI, and you want a community of people that actually care about doing it right, not just hype, but the real nuts and bolts of building and safely, and building smart, and, you know, being around other people building in public, and holding each other accountable, that's what we've created. There's 160 members there that I've

14:26joined in the last 15 days. And we do six live calls every single week to help you take the next step in your AI journey. You could check it out. I'll put a link down below. I really think building with AI is amazing, but building safely with AI, that's the first step. If you haven't subscribed to the channel already, please do. I release four to six videos every single day to help you keep on top of AI news. And make sure you hit the notification bell, because sometimes you won't know when we release videos. You got to hit the little bell down there. Hope you guys have a blessed night. We'll see you in the next one. Bye-bye.