OpenClaw Skills: How to Install, Write and Secure Them After 341 Malicious Ones Found

The author of a Habr article has published a breakdown of the skills system in OpenClaw, after a check of 2857 skills found 341 malicious ones. As the article stresses, these are only the cases that could be found. The piece explains that skills in OpenClaw are not passive content or ordinary plugins, but instructions by which an autonomous agent reads files, runs commands and makes network requests. In effect, a skill gets privileged access to the user's system.

Why OpenClaw skills are not just plugins

• Skills checked: 2857
• Malicious skills found: 341
• Source of risk: the ClawHub marketplace, where users install third-party skills
• Nature of a skill: not content, but instructions that give the agent access to files, commands and the network
• Consequence of a bad installation: running a stranger's code in the agent's privileged environment

Architecturally, the article explains, a skill in OpenClaw is a set of instructions that the agent interprets and executes with the same rights the agent itself has on the system: reading and writing files, running shell commands, making network requests. A classic plugin is usually confined to a strictly defined API and a sandbox. A skill can use any capability available to the agent as a whole.

Because modern autonomous agents often run with broad permissions for the user's convenience, this difference is fundamental. That is why one bad installation of a skill from the open ClawHub catalog amounts to handing a stranger the ability to execute code in a privileged environment, with the same consequences as running an unvetted script as the user on their own machine.

How does the priority system work, and why does order matter?

The article covers where skills are stored, how to create them yourself, and why the priority order among several installed skills matters more than it might seem at first glance. If two skills give conflicting or overlapping instructions, the system's behavior can differ radically depending on which one the agent applies first. That includes cases where a later, malicious skill can override safe instructions installed earlier, and so change the logic of the whole agent without the user noticing.

What to do so convenience doesn't turn into an incident

The author lays out practical protection advice: check the source of a skill carefully before installing it, prefer skills whose instruction code is open and verifiable, limit the agent's own permissions wherever possible, and understand that a catalog like ClawHub, for all its usefulness in quickly extending an agent's capabilities, is by nature an attack vector like any other public repository of third-party code. The difference is that a compromised skill gets access not to an isolated container but directly to the agent's working environment and, often, to the user's data and credentials. That makes the cost of a wrong choice significantly higher than when installing an ordinary third-party package.

A separate part of the article covers how to write your own safe skills. The author advises explicitly limiting, in the skill's description, the list of actions it is supposed to perform; avoiding overly broad wording such as "do whatever is necessary"; and documenting which files, commands and network addresses the skill legitimately uses. That way, during an audit or when a conflict with another skill is suspected, it is quick to tell which behavior is expected and which signals a compromise.

The figure of 341 malicious skills out of 2857 checked matters not in itself but as an indicator of scale. It covers only the cases that were found, so the real share of compromised or outright malicious skills on the platform may be higher. For the OpenClaw user community, this means that the mere fact that a skill is published in the ClawHub catalog cannot be relied on as proof of its safety. Catalog moderation lowers the risk but does not eliminate it entirely, and final responsibility for vetting an installed skill stays with the user.