The #1 most downloaded skill on OpenClaw marketplace was malware
twitter.com
February 19, 2026
1 min read
45/100
Summary
The most downloaded skill on the OpenClaw marketplace was identified as malware, which stole SSH keys, crypto wallets, and browser cookies while establishing a reverse shell to the attacker's server. A total of 1,184 malicious skills were found, with one attacker responsible for uploading 677 packages, exploiting the platform's open publishing policy that allowed anyone with a week-old GitHub account to submit skills.
Key Takeaways
- The most downloaded skill on the OpenClaw marketplace was malware that stole SSH keys, crypto wallets, and browser cookies while opening a reverse shell to the attacker's server.
- A total of 1,184 malicious skills were found on OpenClaw, with one attacker responsible for uploading 677 packages.
- OpenClaw's marketplace allowed anyone to publish skills with just a one-week-old GitHub account, leading to the distribution of disguised malware.
- The top-ranked skill, "What Would Elon Do," contained nine security vulnerabilities, including two critical ones, and was designed to exfiltrate data and bypass safety guidelines.
Related Articles
Claws are now a new layer on top of LLM agents
Feb 21, 2026
You are not supposed to install OpenClaw on your personal computer
Feb 23, 2026
Anthropic announces proof of distillation at scale by MiniMax, DeepSeek,Moonshot
Feb 23, 2026
Claude Code wiped our production database with a Terraform command
Mar 6, 2026