The most downloaded skill on the OpenClaw marketplace was identified as malware, which stole SSH keys, crypto wallets, and browser cookies while establishing a reverse shell to the attacker's server. A total of 1,184 malicious skills were found, with one attacker responsible for uploading 677 packages, exploiting the platform's open publishing policy that allowed anyone with a week-old GitHub account to submit skills.