ClawHavoc and the risk of OpenClaw skills
In early 2026, malicious skills reached ClawHub in large numbers. What happened, how researchers counted it, and how to install skills without inheriting malware.
By OpenClawPro. Published October 25, 2026. Updated October 25, 2026.
A skill gives an OpenClaw agent a new ability, and it runs with the agent's permissions. In February 2026, security researchers found that ClawHub, the public skill registry, had been used to distribute malware at scale. The campaign is known as ClawHavoc. The lesson is simple: a skill is code from a stranger, and should be read before it runs.
What happened?
Attackers published skills with attractive names, some typosquatting popular ones. Their instructions asked users to install a "prerequisite" that was in fact the Atomic Stealer malware for macOS, according to Koi Security's analysis reported by The Hacker News. Publishing was easy: any GitHub account more than a week old could do it.
How many skills were malicious?
It depends on who counted and how. Antiy CERT counted at least 1,184 malicious skills published on ClawHub over time. Koi Security audited 2,857 skills and flagged 341 of them as malicious. The figures differ because the methods differ; both describe the same problem.
Why are skills dangerous?
Because they run inside the agent, with access to what the agent can reach: files, tokens, sometimes a shell. An agent that reads your email and can run commands is a valuable target. A malicious skill does not need to break anything; it only needs to be installed.
How do you install skills safely?
Treat each skill like a dependency in production code:
- Read the source and its dependencies before installing, looking for network calls and anything that runs at install time.
- Test it in a sandbox with no secrets and no network beyond what it declares.
- Write down its permissions: which hosts, folders and secrets it may reach. Refuse the rest.
- Pin the exact version you reviewed by its hash, so a later change upstream cannot slip in.
- Review updates the same way before replacing the pinned version.
OpenClaw's own security guide also recommends sandboxing tools and treating inbound messages as untrusted.
What we do
We install only skills that went through those five steps, and we publish the log of completed reviews on our skills page. It is still short, and we say so; we would rather have a short honest log than a long invented one.
If you run OpenClaw yourself, our free audit script checks 12 points of a server's security and changes nothing: github.com/Delta117-117/openclaw-hardening.