ClawHosters
by Daniel Samer
5 min read
1,184 malicious skills. That's how many SC World reported were found on ClawHub in a single sweep. The ClawHavoc campaign, first uncovered by Koi Security, showed that attackers are targeting openclaw skill security the same way they've targeted npm and PyPI for years. Supply chain attacks. And ClawHub's current vetting? You need a GitHub account that's at least a week old. That's it.
This is why openclaw skill security has to be your responsibility, not ClawHub's. Here's a five-step checklist.
The OpenClaw Skill Security Checklist
1. Check the Permission Declarations
Every OpenClaw skill declares what it wants access to: file system, network, shell commands. Read those declarations before you install anything. A markdown linter asking for network access and command execution? That's suspicious. A web scraper asking for file system write access to your home directory? Also suspicious.
Match the permissions to what the skill actually claims to do. If they don't line up, walk away.
2. Look at the Developer
How old is their ClawHub account? What else have they published? A brand-new account with one skill and 4,000 downloads should raise questions. Researchers from Snyk proved that download counts on ClawHub can be gamed by inflating them to thousands with automated requests, which means popularity alone tells you nothing.
Check if the developer has a GitHub profile with real activity. Look at their other skills if they have any. A track record matters.
3. Use the Built-In Safety Scanner
Version v2026.2.6 introduced a built-in code scanner and credential redaction system. If you're running an older version, update. The scanner catches known patterns like base64-encoded payloads, suspicious network calls, and credential exfiltration attempts.
It won't catch everything. But it catches the low-hanging fruit that makes up the bulk of attacks we've seen so far.
4. Run Through Third-Party Scanners
The built-in scanner is a first pass. For anything you plan to run in production, consider running the skill code through tools like Semgrep, Snyk Code, or even VirusTotal. OpenClaw recently announced a VirusTotal partnership that should make this easier going forward.
Snyk's ToxicSkills study found that 36.82% of skills on ClawHub have some form of security flaw, with 13.4% rated critical. Those numbers are probably too high to ignore.
5. Test in a Staging Workspace First
Don't install a new skill straight into your production agent. Create a staging workspace, install there, and watch the logs. Pin the exact version so it can't auto-update without your knowledge.
Pay attention to what network calls the skill makes during its first run. If it's phoning home to domains you don't recognize, uninstall it immediately. Our security hardening guide covers how to set up network-level monitoring to catch exactly this kind of thing.
Red Flags That Should Stop You Cold
People ask "is openclaw safe?" and the honest answer is: the platform itself is fine, but the skills ecosystem is not well-policed. Good openclaw skill security means knowing what malicious code actually looks like in the wild. Some patterns show up again and again.
Watch for obfuscated code. Base64 strings, eval() calls, minified JavaScript inside a skill that should be simple. The ClawHavoc attackers hid reverse shells inside working code, with the skill functioning normally while quietly exfiltrating .env files in the background.
Network calls to unknown domains are another tell. Skills requesting excessive permissions for what they do. And be wary of any skill that asks you to copy-paste terminal commands from its README. Clipboard-based attacks are real and increasing.
New publishers with zero track record deserve extra scrutiny. Not suspicion by default, but definitely a closer look at the code.
What ClawHosters Does Differently
On ClawHosters managed instances, we pre-vet skills before they reach your agent. Every skill runs through automated security scanning, and instances are container-isolated, meaning a compromised skill can't reach your credentials or other services.
The safety scanner is enabled by default on all instances running v2026.2.6 or later.
You can self-host and handle openclaw skill security yourself by following the checklist above. I think for most teams, though, the time spent vetting skills and configuring isolation is time better spent building.
