575+ Malicious OpenClaw Skills: Where Agent Plugin Trust Boundaries Broke
Researchers found more than 575 malicious OpenClaw skills that delivered malware to Windows and macOS users. The number is the headline. The trust boundary is the story. A skill bundle is two things at once: a manifest that a human skims and a model parses as instructions, and a scripts folder that the host executes. The manifest can declare its allowed tools, but that declaration is only YAML in a markdown file. Nothing in the install path enforces it, and the script never reads it. The execution path that matters: - Discovery and install with no signature or integrity check - The model choosing the skill mid-task, on its own initiative - First invocation spawning a child process - That child inheriting the agent's user account, working directory, environment variables and network That last step is the moment of privilege. If the agent process holds API keys, which it does because that is how the agent works, the child gets them for free. No capability drop, no egress rule, no seccomp filter. What to do instead: enforce capability at spawn time. Drop privileges, hand the child a scrubbed environment, deny outbound network by default, and log every spawn. Audit a bundle before installing it as a read, not a run: grep the scripts folder for anything that spawns a process, and check per-user persistence surfaces such as launch agents on macOS and the per-user Run key on Windows. If a skill already ran, revoke tokens before you collect evidence, because tokens are the expensive loss. The post is explicit about what the source material establishes and what it does not: no malware family names, no install counts, no claim about takedowns are asserted. The technical sections are a reconstruction of the class of bundle that makes this kind of incident possible. Full write-up: https://hackyjs.com/posts/auditing-575-malicious-openclaw-skills-where-agent-plugin-trust-boundaries-broke