OpenClaw skills: install them without getting caught trap

#What an OpenClaw skill actually is

A skill is not a compiled plugin or a browser extension. It is a folder containing at least an SKILL.md file: a YAML-formatted header with a name and description, followed by Markdown instructions explaining when and how the agent should perform a task. The folder may also include scripts, file templates, or reference documents. OpenClaw uses an open format shared with other agents for this purpose, as described in its documentation.

At startup, the gateway does not load the full content of every skill. It injects a list of the available skills, with their names and descriptions, into the system prompt. When the model determines that a skill matches the request, it reads the entire SKILL.md file and follows its instructions, calling the scripts it contains as needed. A skill is therefore primarily text that enters the model's context, just like your own instructions.

---
name: resume-flux-rss
description: Résume en trois points les nouveaux articles d'un flux RSS donné.
metadata: {"openclaw": {"requires": {"bins": ["curl"]}}}
---
# Résumer un flux RSS

1. Récupérer le flux avec curl et ne garder que les entrées des 24 dernières heures.
2. Pour chaque entrée, lire le titre et le résumé fourni par le flux.
3. Rédiger trois points en français, sans ouvrir de lien supplémentaire.

The header can declare activation requirements: executables required on the machine, environment variables, configuration keys, or an operating system. If a requirement is missing, the skill remains visible in the inventory but is not offered to the model. These declarations are for reliability, not security: they do not limit what an activated skill can do.

Bundled skills

Provided with OpenClaw and enabled according to the configuration. They are maintained by the project, which is no substitute for knowing them.

Managed skills

Installed for all agents on the machine, in the skills directory under ~/.openclaw.

Workspace skills

Placed in the skills subdirectory of the agent’s workspace, ~/.openclaw/workspace by default. That is where ClawHub installs them by default.

Priority order

A workspace skill takes precedence over a managed skill with the same name, which takes precedence over a bundled skill. A third-party skill can therefore replace an official skill without notifying you.

ClawHub is the project’s public registry. A command-line tool with the same name lets you search for, install, and update a skill. Anyone can publish there: a skill’s presence in the registry does not mean it has been reviewed. If the concept of agents and tools is still unclear, our guide to the MCP protocol explains what it means to give tools to a model and why each added tool expands the attack surface.

#Why an OpenClaw skill is inherently a risk

The problem is not a defect in OpenClaw. It stems from what a skill is: instructions the model trusts, executed by an agent with access to your terminal, files, browser, and messaging services. Anything the agent can do, a skill can make it do. And unlike a prompt injection from a web page, which the model can sometimes identify as external content, a skill arrives through the channel of legitimate instructions.

False dependency

The skill asks, in the name of a technical prerequisite, to download and run an external installation script. The agent complies, and the script installs malware. This is the most documented pattern on ClawHub in early 2026.

Exfiltration

The instructions call for sending the contents of the conversation, a configuration file, or credentials to an external address, often under the guise of “logging” or “synchronization.”

Persistent hijacking

The skill modifies the agent's memory or instructions, or adds a scheduled task. The effect persists after you uninstall it if you do not review these files.

Usurpation

A name close to a known skill, a copied description, an author created the day before. The registry does not protect against namesakes.

Malicious update

A skill that is honest when installed can change its contents in the next version. It must be reviewed again with every update.

#What security researchers found on ClawHub

Several teams analyzed the registry during the project's popularity wave, between late January and March 2026. We did not reproduce their analyses. The figures below are those from each report, as of its publication date, and the registry has changed since then. In line with our editorial policy, we publish neither a list of malicious skills nor links to them.

Koi Security, February 1, 2026

The researchers describe a campaign they call ClawHavoc: in their first report, 341 skills published on ClawHub were identified as malicious. Many used the fake-dependency scheme to install an information stealer on macOS. The same researchers later revised this total upward in subsequent publications.

Cisco, February 2026

Cisco’s research team analyzed a popular skill from the registry and showed that it contained instructions causing the agent to transmit data to a third-party server without the user’s knowledge. Cisco promptly published a free, open-source skill analysis tool and concluded that personal agents of this type require a security framework that most users do not yet have.

Snyk, February 2026

In its ToxicSkills report, Snyk says it analyzed 3,984 ClawHub skills. According to the report, 13.4% had at least one security issue, and 76 were considered malicious, led by credential exfiltration and malicious installation scripts.

Kaspersky, early 2026

The analysis published on Securelist places the skills in a broader context: gateways exposed to the Internet, CVE-2026-25253 fixed in late January 2026, and secrets stored in plain text in the configuration folder. Its recommendations align with those in this guide: isolate, limit privileges, expose nothing.

The project responded. According to its February 2026 announcements, ClawHub now submits published skills to an automated malicious-code analysis in partnership with VirusTotal and removes those that are flagged. That is useful, and insufficient: automated analysis detects known scripts and obvious patterns, not a skillfully worded instruction. Reading remains your responsibility.

#The framework to establish before the first skill

This guide assumes OpenClaw is already installed. If it is not, our Docker installation guide details the setup, and our OpenClaw overview helps you decide whether the tool is right for you. Before adding any third-party skill, check these four points.

An up-to-date version

Skills are only one attack surface. An outdated gateway remains vulnerable to flaws that have since been fixed, including CVE-2026-25253. Update it, then rerun the diagnostic.

A clean audit

The built-in audit command flags dangerous settings: exposed gateway, disabled pairing, tools open to everyone. Fix everything before expanding the agent’s scope.

A dedicated machine

Not your work computer, and not the machine running your password manager or personal SSH keys. Use a virtual machine, a mini PC, or a rented server.

A named need

A skill addresses a specific task you already perform. Installing a skill “just in case” adds risk without benefit.

# Mettre à jour OpenClaw puis vérifier l'installation
openclaw update
openclaw doctor

# Audit de sécurité de la passerelle et de ses réglages
openclaw security audit --deep

# Inventaire des skills déjà présentes et de leurs prérequis
openclaw skills list
openclaw skills check

The inventory may surprise you: skills shipped with OpenClaw are already active. Take the time to read the ones you do not know, and disable the ones you do not need. The principle is the same as for a server: every active component should have a reason to exist.

#Read an OpenClaw skill before activating it: the method

The classic mistake is to install first and read later. As soon as a skill is present in a folder loaded by OpenClaw, the agent can read and follow it. The method is therefore to retrieve the skill into a quarantine folder that the gateway does not monitor, examine it, and only then move it. Allow ten to fifteen minutes for a reasonably sized skill. If the skill is too long to read, that is already useful information.

1. 01
   Retrieve without activating

   Create a quarantine folder outside the directories loaded by OpenClaw and move into it before launching the ClawHub tool. By default, it installs into the skills subfolder of the current directory or detected workspace: check the path it displays at the end. You can also read the skill on its registry page before downloading anything.
2. 02
   Read SKILL.md in full

   Start with the header: does the name match what you were looking for, and are the stated prerequisites consistent with the task? An RSS feed summarization skill does not need your environment variables containing keys. Then read the body sentence by sentence, asking yourself for each instruction: if the agent does exactly this, what happens on my machine?
3. 03
   Inventory the files

   List all the folder’s contents, including hidden files. Every script, archive, or binary must be justified by the instructions. A file that SKILL.md never mentions is a warning sign. Binaries and compressed archives should be rejected: you cannot read them.
4. 04
   Look for known patterns

   Downloads followed by execution, base64 decoding, dynamic code evaluation, privilege escalation, external addresses, paths to the configuration directory or keys. The commands below automate this first pass. Also look for invisible characters: instructions can be hidden in text that appears empty.
5. 05
   Verify the author and history

   Account creation date, other posts, successive versions, the cited code repository, and whether it matches the downloaded content. An “official” skill from a known service published by an anonymous account is impersonation until proven otherwise.
6. 06
   Decide, and note why

   An instruction asking you to run a script retrieved online is enough to reject it, even if everything else looks clean. If you accept, keep a copy of the version you reviewed: that is the one you will compare with the next update.

cd ~/quarantaine-skills/nom-de-la-skill

# Tout le contenu, fichiers cachés compris
find . -type f | sort

# Téléchargement + exécution, décodage, évaluation dynamique, droits
grep -rniE 'curl|wget|bash -c|sh -c|base64|eval|chmod \+x|sudo' .

# Toutes les adresses externes citées
grep -rnoE 'https?://[^ )"]+' . | sort -u

# Accès aux secrets et à la configuration de l'agent
grep -rniE '\.openclaw|openclaw\.json|\.ssh|keychain|token|api[_-]?key|password' .

# Caractères invisibles (espaces de largeur nulle, marque d'ordre des octets)
grep -rnP '[\x{200B}\x{200C}\x{200D}\x{2060}\x{FEFF}]' . || echo "Aucun caractère invisible trouvé"

These commands do not decide for you. A legitimate skill may cite an external address because it queries a public API, or use curl because that is its function. The signal is the gap between what the skill claims and what it does. An RSS feed summary that reads your configuration file has no excuse.

#Install with the fewest possible privileges

Once you have reviewed the skill, move it to the workspace's skills directory, or let the ClawHub tool install it in the right place. You can then use OpenClaw's configuration, in the openclaw.json file under ~/.openclaw, to disable it, provide it with a dedicated key, and restrict the delivered skills to the ones you use. The exact names of these keys change between versions: the documentation's skills page is authoritative.

{
  "skills": {
    "allowBundled": ["nom-de-skill-livree-que-vous-utilisez"],
    "entries": {
      "resume-flux-rss": { "enabled": true },
      "skill-en-cours-de-relecture": { "enabled": false },
      "skill-qui-appelle-un-service": {
        "enabled": true,
        "apiKey": "cle-dediee-a-cet-usage-et-plafonnee"
      }
    }
  }
}

Disabled by default

An installed skill that has not yet been reviewed, or one that has been reviewed but is not yet needed, must be explicitly disabled. A disabled entry is not offered to the model.

Dedicated keys

If a skill needs access to a service, create a key dedicated to that purpose, with a spending limit and the narrowest possible scope. Never use your primary key, and never use a key shared between skills.

Dedicated accounts

The same logic applies to accounts: a skill that reads a calendar or mailbox receives an account created for the agent, not yours.

Reduced bundled skills

Restrict the list of bundled skills to those you actually use. The fewer options the model has, the fewer levers a deceptive instruction has.

No automatic updates

Do not launch a bulk update of all skills. Update one skill at a time, compare the new version with the copy you kept, then reactivate it.

After every change, rerun the inventory and diagnostics. The skill verification command will tell you whether the skill is active, whether its prerequisites are satisfied, and which variables it expects. If it requests a variable you did not plan for, go back to reading.

#Isolate the agent: limit what a malicious skill can access

Reading reduces the likelihood of installing a malicious skill. Isolation reduces the consequences if you make a mistake. Both are necessary, and the second matters more than the first: one day you will review something poorly, or an update will slip past you. The goal is for a skill that tries to exfiltrate your secrets to find nothing to exfiltrate, and for a script that tries to install itself to have nowhere to do so.

Sandbox for execution

OpenClaw can run the agent's tools in a Docker container instead of directly on the machine. By default, this isolation targets conversations other than yours; the documentation explains how to extend it to all sessions. With a container, a malicious command acts on a disposable system, not on your host.

Removed tools

The configuration lets you prohibit tools for an agent. If none of your skills needs the browser or file writing outside the workspace, remove them. A skill cannot use a tool the agent does not have.

Dedicated system account

The gateway runs under a user who has no access to your SSH keys, documents, or administrative privileges. Docker mounts provide access only to the ~/.openclaw directory.

Closed network

The gateway remains listening locally on 127.0.0.1 and port 18789 by default, and remote access goes through an SSH tunnel or VPN. If your firewall allows it, also limit the agent’s outbound connections to the services it actually needs to reach: exfiltration requires an exit.

Capable model

A model that understands instructions well is more resistant to deceptive ones. Locally, that means a model with at least 14 billion parameters, requiring about 9 GB of VRAM in Q4_K_M, with a large context. Our guide to OpenClaw with Ollama explains this choice in detail.

If the agent connects to external tools through the MCP protocol, the same rules apply to each MCP server: read before activation, least privilege, isolation. Our guide to the Ollama server and our take on the OWASP Top 10 for LLMs provide the general framework for these measures.

#Monitor, remove, report

An installed skill is not a set-it-and-forget-it asset. Three habits limit surprises. First, periodically review the workspace’s memory and instruction files, which are plain Markdown. Any line you did not write must be understood and then deleted. Second, review the gateway logs after adding a skill to verify that the commands executed and addresses contacted match what you expected. Third, repeat the security audit after every configuration change.

# 1. Désactiver la skill dans ~/.openclaw/openclaw.json (enabled: false),
#    puis supprimer son dossier
rm -rf ~/.openclaw/workspace/skills/nom-de-la-skill

# 2. Redémarrer la passerelle et vérifier l'inventaire
openclaw gateway restart
openclaw skills list

# 3. Relire la mémoire et les consignes de l'espace de travail
ls -la ~/.openclaw/workspace

# 4. Refaire l'audit
openclaw security audit --deep

If you later discover that a skill was malicious, consider everything the agent could reach compromised: revoke and recreate the API keys it held, change the passwords for accounts entrusted to it, and examine the host machine if the agent was running without a sandbox. Then report the skill to the registry and, if it served a malicious script, to the teams tracking these campaigns: all the reports cited above began with tips.

#Sources

This guide contains no in-house measurements. The commands and configuration keys come from OpenClaw’s documentation, which is evolving quickly: in case of discrepancies, it takes precedence. The findings about malicious skills come from the following reports, consulted for this article; the Koi Security and Snyk reports are published on the blogs of those two companies.

https://docs.openclaw.ai/tools/skills

https://docs.openclaw.ai/tools/clawhub

https://docs.openclaw.ai/gateway/security

https://securelist.com/openclaw-security/120484/

https://blogs.cisco.com/ai/personal-ai-agents-like-openclaw-are-a-security-nightmare

https://nvd.nist.gov/vuln/detail/CVE-2026-25253

#Go further

Skills are only one part of a local agent's security. These site guides cover the rest of the picture:

Prompt injection: local doesn't protect you

The mechanism by which text read by the model becomes an instruction, and why running the model at home is not enough. https://quelllm.fr/guide/injection-de-prompt-llm-local

OWASP Top 10 LLM: Securing Your Local AI in the Enterprise

The catalog of the ten risks specific to LLM-based applications, including the supply chain and excessive agent autonomy. https://quelllm.fr/guide/owasp-top-10-llm-securite-locale

Secure your Ollama server

Authentication, reverse proxy, and exposure: model-side measures that complement those on the agent side. https://quelllm.fr/guide/securiser-serveur-ollama

MCP: what is it?

The protocol that connects a model to external tools, and what each added server entails. https://quelllm.fr/guide/mcp-c-est-quoi-model-context-protocol

OpenClaw: what is it, and should you install it?

The project's overview, prerequisites, and general risks, so you can decide before installing. https://quelllm.fr/guide/openclaw-c-est-quoi