Hundreds of Malicious OpenClaw Skills Discovered

OpenClaw, is a self-hosted personal AI assistant that is all the rage lately. However, its centralized skills repository, ClawHub, has been found to have 314 malicious AI skills to be used in malware campaigns and other compromises.

Indications are that the malicious AI skills uploaded to ClawHub are not just one-off attacks but are a “systemic threat” to OpenClaw and ClawHub.

These AI skills appear a legitimate agents, but are intended to exfiltrate data, install backdoors, and execute other compromises.

As predicted, OpenClaw is an opsec nightmare.

About NoVaLUG

The Northern Virginia Linux Users Group (NoVaLUG)

We are a curious, informal, and friendly mix of IT professionals, hobbyists, students, and others with an interest in Linux, Free and Open Source software, and open knowledge. The Northern Virginia Linux Users Group (NoVaLUG) is the oldest LUG in the Northern VA area and likely in the whole of US, established in 1993.

Obtaining an Account

Accounts on this server are limited to members of NoVaLUG. To get an invite link, you must do one of the following:

Ask for a link at one of our meetings.
Send a message on our mailing list asking for a link.
Request an invite link in our Signal chat group.

Service Information

Users on this server may be referred to with the novalug.org domain name (e.g. "foo@novalug.org" or "@foo@novalug.org"). However, when using URLs, the full hostname of akk.novalug.org must be used (e.g. "https://akk.novalug.org/foo").

To use this server with other clients, such as mobile apps, use the full host name of akk.novalug.org.

If you prefer the "classic" Mastodon UI, go here.

Code of Conduct

Our rules are simple.

Be kind, be courteous.
No porn.
No spam.
No harassment.
No illegal behavior.
Users must be 13 years of age or older.

We reserve the right to reject, delete, moderate and take any other action necessary. Simply put, don't be a jerk!