The Discovery
During a routine audit of the skills directory, we identified a coordinated campaign to distribute malicious skills through the OpenClaw ecosystem. Six accounts had published over 210 skills that appeared to be legitimate tools but contained hidden payloads designed to compromise users' machines.
The skills covered popular categories including wallet trackers, browser automation, PDF tools, and YouTube downloaders. On the surface, they looked like useful utilities. Underneath, they embedded base64-encoded scripts that would execute remote code when installed.
The Threat
Here's what the malicious skills were designed to do:
- Remote code execution: Hidden base64-encoded payloads decoded and piped to
bashduring installation - Second-stage downloads: The decoded scripts reached out to a known malicious IP to download additional payloads
- Cross-platform targeting: Variants existed for both macOS and Windows users
- Gatekeeper bypass: macOS-targeted payloads included
xattrcommands to bypass Apple's quarantine protection - Password-protected archives: Some variants distributed password-protected archives to evade automated scanning
agent-browser-6aigix9qi2tu, phantom-0jcvy, solana-07bcb) to maximize surface area.
Our Response
We took immediate action:
- Base64-encoded payloads piped to shell commands
- Known malicious IPs and domains
- Suspicious install instructions (curl/wget piped to bash)
- Gatekeeper bypass commands
- References to known fake repositories
- Long encoded strings that may hide payloads
The Verified Skills Program
Beyond automated scanning, we launched the Verified Skills program. This is a free program where skills can earn a Verified badge after thorough manual code review.
How It Works
- Scan: Every skill in the directory is automatically scanned using pattern-based detection with severity scoring. Skills scoring above our threshold are blocked.
- Review: Flagged skills are manually reviewed by our team. We examine the source code, install commands, and runtime behavior.
- Verify: Skills that pass full code review earn the Verified badge, visible throughout the directory.
Badge Guide
When browsing skills, look for these badges:
- Verified (blue shield with checkmark): Manually reviewed and approved by our team
- Scanned (green shield): Passed automated security scanning
- Flagged (yellow warning): Under review, use with caution
Apply for Verification
If you maintain a skill and want it verified, apply here. Verification is completely free. We review applications and provide feedback within a few days.
What This Means for You
For agents installing skills: Every skill you see in our directory has been scanned. Look for the Verified badge for maximum confidence. Skills from blocked authors will never appear.
For skill creators: Your legitimate skills are now better protected from being buried by spam and malware. Apply for verification to stand out and build trust with users.
For the ecosystem: This is an arms race, and we're committed to staying ahead. Our scanner rules are continuously updated, and we maintain a blocklist of known malicious patterns, IPs, domains, and accounts.
Technical Details
Our scanner uses a severity-scored pattern matching system:
| Severity | Score | What We Check |
| Critical | 25 | Base64 payloads piped to bash, known malicious IPs/domains |
| High | 15 | curl/wget piped to shell, raw IP connections, known fake repos |
| Medium | 8 | Long encoded strings, eval/exec calls, Gatekeeper bypasses |
The scanner runs at three points:
Stay Informed
We're committed to transparency about security. If you discover a suspicious skill or have security concerns, reach out through our platform or file an issue. The safety of the agent ecosystem depends on all of us.
Browse Verified Skills | Apply for Verification | Skills Directory