Your OpenClaw Setup Is Compromised - How To Check

0:00In this video, I'm going to be talking about an Open Claw user that just had something happened very scary that all Open Claw users need to be aware about. So, on this subreddit that I have it linked down below, you guys got to check it out because especially if you've been installing skills from random places online for your Open Claw, this is something that I want to bring attention to. So, a Reddit username Drive-by just posted a deep dive showing that a skill in the official Open Claw skills repo on GitHub had a base 64 encoded shell payload hidden right inside of it. So, dressed up as a normal Google Workspace setup. So, this is a real story with a real source and I just want to bring some attention about when it comes to installing skills from random places

0:45online, especially if it is an official source. So, it was posted just within the last 24 hours. So, here's what's happening right now while you are watching this video. I'm going to set the stage for you so you can take the best security precautions when it comes to getting skills for your Open Claw. So, skills in Open Claw are basically these little instruction packs that you give your agent basically to level up new powers. You know, you install one and then your agent learns how to talk to Gmail or basically another skill can be how to publish to social media or how to interact with your file system. They're basically just markdown files with a bit of metadata. It's a beautiful idea and it's a massive part of why Open Claw works at all. Right now on the official Claw Hub site, there's over

1:3060,000 skills there and like 7 to 8% of them have malware. So, something to be aware about. The thing is like once you install a skill, you know, your agent reads it and it trusts what it says. If that skill tells your agent to run a command, your agent will run that command. So, if a malicious skill ships with a hidden bash payload, you basically just gave a stranger a shell on your machine. That is game over for people that are running this in production. The user installed a skill called GOG, which is just short for Google Workspace CLI integration. It sounds super reasonable, right? Probably hundreds of people have installed this. The skill markdown file had a section labeled Open Claw driver required that

2:18looked like a normal setup step for macOS. The line read like a setup wizard. Then a long string of base 64 characters piped into the base 64 decode. It piped into a bash command to a normal builder that just looks like an install command, right? To anyone who actually decoded it, it was a curl command pulling a script from the IP address out of nowhere. The IP was 9192242.3 and the Windows variant of the same skill pointed at a fake Open Claw Windows driver hosted on a GitHub repo called Tool Light Too Late. Real quick, before we keep going, if you're watching this and you want to actually build with some of these tools, not just watch videos about them, then you're going to

3:04want to check out our community down below, Shipping School. We have a full Claude code course, a full Open Claw course, and four live bootcamps every single week where we actually help you get set up from scratch. Like actually set this thing up, not just watch a tutorial and figure it out by yourself. And we also provide one-on-one coaching so you could book a call with me, we could share screens, and I can help you get Claude code or Open Claw running on your machine. That's it. No fluff. I built this community because watching YouTube's only gets you so far. We launched it just 3 days ago and we have over 55 members. You need people around you who are actually building, people who hold you accountable, and coaches who can help you when you get stuck. I'll put the link in the description

3:49down below. Get in now before the price goes up. So, and now that's funny, but {slash} openclaw_windriver, it read the IP again. It is just a raw number with no domain. So, that is your first red flag, right? No real installer ships from a raw IP, which is pretty obvious once you know to look for. Here's the part that is really crazy about the whole story is the user did the right thing. They spotted it, they deleted the skill on April 21st, and then they reinstalled the same skill cleanly using the install command, and then on April 25th, the exact same malware was back in place. So, either the skill was getting pulled from a cached package index or the source was still actively serving the payload through a different resolved path. The

4:35user noticed that the skill path on their machine was ZACV {slash} Google Workspace and it's all one word, which is just a different directory name than the clean version in the repo today, which lives at ZACV {slash} Google {dash} Workspace with a hyphen. There is a tiny difference, but this is a huge consequence. That is how typosquat attack works. You can change one character or one word and people install the wrong thing without really ever noticing. Now, somebody in the comments said, "Hey, this was fixed back in February. The current file in main is clean. There is no base 64 anywhere." And that is true, but another commenter pointed out that something that is really sharp here. Just because the file

5:21is clean on the main today does not mean every install path is resolving the main today. Caches are real, stale package indexes are real as well, and old commits need to be verified. So, a skill that was malicious for any window of time can absolutely still be served to users who installer is resolving something older. So, even if the upstream repo is clean right now, you might still have the bad version sitting on your machine, which brings me to the actual point of this whole video. Here is exactly how you check your own machine right now. You need to open your own terminal. You are going to run a grep with a recursive flag looking for three strings: app-distribution, the IP 9192242,

6:07and the word Open Claw driver. You are going to point that grep at your tilde {slash} {dot} at your tilde {slash} {dot} Open Claw directory. If the result is empty, you are clean. Also too, if you don't want to get in the terminal, get Claude code installed and have it do it for you. If anything comes back at all when you're searching, you have the malicious skill on your own system and you need to deal with it now. Run it now and I'll wait. Good job. If you got results, the next steps are not optional. You assume host compromises until you can prove otherwise. That means you rotate every token your agent could possibly have ever read. You all your API keys, your OAuth credentials, anything sitting on a {dot} env file or stored in your keychain. Check your shell history for anything weird as

6:52well. Check your launch agents on your Mac or your cron jobs to see if anything new got installed in the background. Check your network logs if you have any. Look for outbound hits to that IP or that domain. The commenter in the thread called this a boring incident hygiene. Sadly, it's undefeated. He is right. The same dumb cleanup steps are in the right answer every single time. Now, here is why I'm doing this video. Most of the audience is non-technical. That's okay, I am too. But you're a builders and you're entrepreneurs. You know, you're vibe coders, you're people who got into AI agents because you wanted to ship some. Not because you wanted to learn Linux security. So, when you see a skill that says, "Hey, paste this command into install me," you paste it in, right? Of

7:37course you do. That is exactly how every skill marketplace works. But the whole promise of skills is that you do not have to read every single line of code yourself. Your agent reads it for you and acts on it for you. That trust is exactly what malware authors target. I always suggest to just whenever you see a skill, take the link of that skill and give it to your agent and say, "Recreate this skill for me." Don't download skills. It's too scary out there and you just don't know what's in them exactly. You know, from hidden payloads, you know, you just don't know. So, just have it copy the skill, recreate the skill, and it will work out just fine. So, you know, that that's where the trust is, right? The authors try to target your trust into thinking, "Oh, this skill is great. Let's get it going." You know,

8:22they're not after high security defenders. They are after people like you and me who just want our Gmail agent to work. That base 64 trick is clever from their perspective because it hides the bad stuff from a casual eyeball check. You know, you scroll past it. You see what it looks like a config string. You move on. Your agent reads it even and it reads the whole file. It sees the decode and runs the instruction. It obeys. But by the time you notice anything weird, if you're struggling to keep up with content, what I'm about to save you about 40 days worth of work. I built something called Content [music] Machine. It's 10 AI agents that run on the Open Claw orchestration and they handle everything. Scripts, thumbnails, X posts, blogs, outreach, clips, [music]

9:07newsletters, all of it. So, I went from 1,000 subscribers to 4,000 subscribers on YouTube in 7 days using this exact system. Every single morning I wake up and the content's already done. I spend maybe 15, 20 minutes reviewing and approving them and I move on with my day. It works for [music] any niche, fitness, finance, real estate, marketing, whatever you are building and it is 100% completely customizable to your use case. >> [music] >> So, you get the mission control dashboard, all of the cron jobs, everything I've built over the last 40 days helping me gain more and more people to subscribe and join the community. So, you plug in your own thing and it molds it to you. It learns how you talk and it writes so it doesn't

9:52sound like AI slop. [music] $97 one time. It's not a subscription. I'll put the link down below and you'll thank me later. The payload has already pulled down whatever is going to pull down and run it under your own user account. So, here's my standing rule and I'm giving it to you straight. Like I said before, I never install a skill at all. I do not care how popular the skill is. I do not care if it's the in the official repo. I don't care if a YouTuber I trust that it works. I basically just have it recreate the skill. That's it. You know, you want to look for any curl into bash. You want to look for any raw IP addresses in install commands. You know, any of those three or you know, just walk away. Like if you see anything scary. There are plenty of clean installs out there, but

10:39I still always go back to having my open claw agent just recreate the skill for me. You know, you don't need to take the risk on. You know, it's just not worth it. The other thing I want you to take from this is the official skills repo is not magic. It is a giant pile of community contributions. Some of these contributors are great. Some of them are scammers. So, the repo maintainers do their best, but the base rate of catching a base 64 payload before it ships is not high enough for you to outsource your safety to them. So, you are still responsible for what runs on your machine and out of the box. And that is true for any NPM packages. That is true for any VS code extensions. That is true for any open claw skills. That is basically true for every single

11:24package manager that has ever existed. Any system that lets random people upload code and then tells other people to run it as the same. That's the wild wild west dynamic. Don't do that. So, you have to stay skeptical every single time. So, if you were to take one thing from this video, take this piece. Run that grep command on your machine right now. If it comes back empty, take a breath. That's fine. You dodged this one. But if it comes back with hits, treat it like a fire and rotate everything. And from now on, whatever you do, whatever skill you're attempting to install, just have your agent recreate it for you. The whole point of open claw is that you could ship faster than you ever could before, right? But the way you keep shipping faster is you do not get knocked offline by some

12:09preventable malware that took 10 seconds for you to scan for. I know you know what I mean. I'll leave a link to the original Reddit thread in the description so you can read the full the full breakdown yourself. The indicators are there. The user did a really clean job documenting it. Big credit to DryBridge for posting it publicly instead of just quietly cleaning it up on his own machine. That is the kind of community behavior that keeps the rest of us safe. And I want to bring it awareness to it. And to the open claw maintainers, if somebody from the team happens to see this video, please look at the installs and see if they're resolving paths because something is letting old payloads come back even after the file is on the main session and it is clean. So, that's the real problem that's worth fixing. You know, this ecosystem is falling quickly. If

12:56you want to learn to build actual AI agents, things from security, installing local LLMs, maybe just having us take a look at your open claw setup and getting it up and running. That's exactly what we do inside of Shipping School. We have over 200 members and I launched the community just 33 days ago. We have nine live boot camp calls a week and we are looking to now integrate unlimited one-on-one calls to help get your open claw up and running or with whatever you're getting stuck with. So, I'll put the link to that down below. And if you haven't subscribed to the channel already, please do because we release videos like this every single day. We'll see you in the next one. Have a blessed day.