Security Reminder: A total of 1,184 malicious skills have been identified on the ClawHub marketplace, potentially stealing SSH keys, crypto wallets, and more.

GateUser-6433627c · 2026-02-20T03:12:26+00:00

SlowMist founder Yu Xian warned that the OpenClaw market has identified 1,184 malicious skills that may steal sensitive information. He recommends users operate AI tools in isolated environments to mitigate risks. Additionally, he mentioned that Moonwell was hacked for $1.78 million, with the root cause being a code flaw.

GateUser-6433627c

2026-02-20 03:12:26

Abstract generation in progress

On February 20th, SlowMist founder Yu Xian reposted a security alert. Currently, the OpenClaw ClawHub marketplace has identified 1,184 malicious skills. These skills can steal SSH keys, encrypt wallets, browser passwords, and open reverse shells. One attacker uploaded 677 packages. The top-ranked skill has 9 vulnerabilities and has been downloaded thousands of times. Yu Xian warned users that text is no longer just text, but instructions. It is recommended to use AI tools in isolated environments. Many OpenClaw skills pose potential risks. Additionally, in Web3 security, contracts are only part of the picture; the true cause of incidents has long been more than just the contracts. A few days ago, Moonwell was hacked for $1.78 million, with the flawed code originating from Co-Authored-By: Claude Opus 4.6.

WELL19,75%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

2 Likes