Security Alert: The ClawHub Marketplace has discovered a total of 1184 malicious skills that may steal SSH keys, encrypt wallets, etc.

BlockBeats News, February 20th, SlowMist founder Cosmos Yu reposted a security alert. Currently, on OpenClaw's ClawHub marketplace, 1184 malicious skills have been discovered. These skills will steal SSH keys, encrypt wallets, browser passwords, and open a reverse shell. A single attacker uploaded 677 packages. The top-ranked skill has 9 vulnerabilities and has been downloaded thousands of times.

Yu reminded users that text is no longer just text, but a command. It is recommended to use AI tools in an isolated environment, as many OpenClaw skills carry potential risks. In addition, in Web3 security, the contract is only a part of it. The true cause of incidents is no longer just the contract. A few days ago, Moonwell was hacked for $1.78 million, with the vulnerable code co-authored by Claude Opus 4.6.