41% of the Most Popular OpenClaw Skills Have Security Vulnerabilities
Findings from 2,890+ Security Audits, and What They Reveal About Securing the Agentic Internet
FEBRUARY 2026
Published by ClawSecure | clawsecure.ai
Author: J.D. Salbego, Founder
01. Executive Summary
Nearly 1 in 3 of the most widely-used OpenClaw skills contains at least one HIGH or CRITICAL severity vulnerability.
That is the headline finding from the largest public security analysis ever conducted of the OpenClaw agent ecosystem, and it only scratches the surface of what ClawSecure’s technology reveals.
ClawSecure scanned 2,890+ skills drawn from the community-curated awesome-OpenClaw repository.
ClawSecure's technology represents the world's first global standard for securing individual skills and certifying agent swarm workflows.
What ClawSecure's Analysis Reveals
41.7% of the most widely-used OpenClaw skills contain substantive security findings beyond missing metadata, including command injection, data exfiltration, credential exposure, and ClawHavoc malware indicators.
539 skills (18.7%) exhibit indicators associated with the ClawHavoc malware family including C2 server callbacks, credential harvesting, and data exfiltration through various services.
99.3% of skills ship without a config.json, the equivalent of a mobile app with no permissions manifest.
02. The ClawSecure Approach: Five Pillars of Agentic Security
2.1 Agentic Intent Verification
ClawSecure verifies whether an Agentic Workflow is integral and whether the code actually running on the user's machine does what it claims to do.
2.2 Agent-Native Auditing
ClawSecure’s 3-Layer Audit Protocol is purpose-built for agent architectures, developed to detect AI agent-specific threats.
2.3 Watchtower: Anti-Sleeper Protection
Watchtower is ClawSecure's continuous integrity monitoring system, detecting skills’ code modifications post-installation.
2.4 Context-Aware Intelligence
ClawSecure’s intelligence understands diverse agent capabilities, distinguishing real threats from standard operations.
2.5 The Identity Bridge
ClawSecure connects code integrity to human accountability via a tiered verification system.
03. Methodology
All skills were scanned using ClawSecure's 3-Layer Audit Protocol.
Each skill receives a score from 0 to 100 based on the number, severity, and type of findings detected.
04. Key Findings
4.1 Score Distribution
| Score Bracket | Risk Level | Skills | Percentage |
|---|---|---|---|
| 91-100 | Safe | 1,746 | 60.4% |
| 81-90 | Verified | 303 | 10.5% |
| 71-80 | Moderate | 486 | 16.8% |
| 61-70 | Moderate | 81 | 2.8% |
| 51-60 | Moderate | 57 | 2.0% |
| 41-50 | Concerning | 22 | 0.8% |
| 31-40 | Concerning | 33 | 1.1% |
| 21-30 | High Risk | 18 | 0.6% |
| 11-20 | High Risk | 33 | 1.1% |
| 0-10 | Critical | 111 | 3.8% |
4.2 Vulnerability Prevalence
ClawSecure’s 3-Layer Audit Protocol detected 9,515 individual findings across all 2,890+ scans.
| Severity | Findings | Percentage | Skills Affected |
|---|---|---|---|
| CRITICAL | 1,587 | 16.7% | 628(21.7%) |
| HIGH | 1,205 | 12.7% | — |
| MEDIUM | 4,193 | 44.1% | — |
| LOW | 38 | 0.4% | — |
| INFO | 2,438 | 25.6% | — |
4.4 The Top 10 Specific Findings
| Rank | Severity | Count | Finding |
|---|---|---|---|
| 1 | MEDIUM | 2870 | Missing config.json |
| 2 | INFO | 2371 | Missing license field in manifest |
| 3 | CRITICAL | 360 | Suspicious domain: glot.io (exfiltration) |
| 4 | CRITICAL | 304 | Command injection: shell operators |
| 5 | CRITICAL | 266 | Outbound HTTP POST requests |
| 6 | HIGH | 257 | Access to MEMORY.md (agent memory) |
| 7 | MEDIUM | 234 | Network library imports (requests) |
| 8 | MEDIUM | 231 | Undeclared network requirement |
| 9 | HIGH | 185 | Access to SOUL.md (agent personality) |
| 10 | HIGH | 128 | Pipe-to-shell patterns (curl) |
05. The Threat Landscape
539 skills (18.7%) show indicators associated with the ClawHavoc malware family.
06. Continuous Integrity Monitoring: The Watchtower System
Watchtower continuously monitors all skills, capturing real-time changes and potential vulnerabilities.
07. The Context-Aware Challenge
ClawSecure's Context-Aware Intelligence resolves false positive problems in scanning, providing a reliable understanding of agent behaviors.
08. The Vaccination Effect: 3,000 Skills, 2.2 Million Agents
Securing the 3,000 source skills directly correlates to the security of the 2.2 million instances running on those skills.
09. The Agentic Risk Model
The vulnerabilities highlight fundamental architectural properties making AI agents different from traditional software.
10. Recommendations
10.1 For Users
- Scan before you install.
- Monitor for changes.
10.2 For Skill Creators
- Include a config.json with every skill.
- Get scanned and earn Verified status.
10.3 For Platforms and Marketplaces
- Implement runtime integrity verification.
- Integrate the Security Clearance API.
11. About ClawSecure
ClawSecure is the independent integrity layer for the agentic internet, providing comprehensive auditing and monitoring services for AI agents.
About the Author
J.D. Salbego is the founder of ClawSecure, with extensive experience in building platforms in Web3, DeFi, and AI-driven systems.
Appendix: Definitions & Glossary
- Agentic Intent Verification: Capability to verify whether an agent’s actual behavior matches its stated purpose.
- C2 (Command and Control): Server infrastructure used by attackers to control compromised systems.
- ClawHavoc: A malware family targeting the OpenClaw ecosystem.