SlowMist Cosine: ClawHub Market detects malicious activity that may steal SSH keys, crypto wallets, and more

SmartContractAuditor · 2026-02-20T04:35:20+00:00

Odaily Planet Daily reports that SlowMist founder Yu Xian posted on the X platform stating that currently, OpenClaw's ClawHub marketplace has identified a total of 1,184 malicious skills. These skills can steal SSH keys, encrypt wallets, browser passwords, and open reverse shells. A single attacker has uploaded 677 packages. The top-ranked skill has 9 vulnerabilities and has been downloaded thousands of times.Yu Xian warns users that text is no longer just text, but instructions. It is recommended to use AI tools in a separate environment, as many OpenClaw skills pose potential risks. Additionally, in Web3 security, smart contracts are only part of the picture; the true causes of incidents have long gone beyond just the contracts. A few days ago, Moonwell was hacked for $1.78 million, with the flawed code coming from Co-Authored-By: Claude.

SmartContractAuditor

2026-02-20 04:35:20

Odaily Planet Daily News: Slow Fog founder Yu Xian posted on the X platform stating that currently, OpenClaw’s ClawHub marketplace has identified a total of 1,184 malicious skills. These skills can steal SSH keys, encrypt wallets, browser passwords, and open reverse shells. A single attacker has uploaded 677 packages. The top-ranked skill has 9 vulnerabilities and has been downloaded thousands of times.

Yu Xian warned users that text is no longer just text, but instructions. It is recommended to use AI tools in isolated environments, as many OpenClaw skills pose potential risks. Additionally, in Web3 security, contracts are only part of the picture; the true causes of incidents have long been more than just the contracts. A few days ago, Moonwell was hacked for $1.78 million, with the flawed code originating from Co-Authored-By: Claude Opus 4.6.

WELL4,9%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

2 Likes