Malware Found in OpenClaw Community Skills — Crypto Theft Alert

A major scandal hit Reddit: malicious scripts stealing cryptocurrency were discovered in the Clawdbot/OpenClaw community skills repository. The post on r/webdev got 2,784 upvotes.

What Happened

• Malicious skills found in official community skills repo
• Scripts designed to steal cryptocurrency
• Project creator knew about the problem but "didn't know what to do"

Detailed Analysis

https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

Community Reaction

r/webdev (2,784 upvotes):

• Criticism of "vibe coding" approach
• Discussion of maintainer responsibility
• Questions about AI agent security

r/theprimeagen (970 upvotes):

• "Senior Vibe Coder dealing with security"

r/ProgrammerHumor (1,360 upvotes):

• "seniorVibeCoderDealingWithVulnerabilityAsAService"

The Core Problem

AI agents have access to:

• File system
• Network
• API keys
• Potentially crypto wallets

Malicious skill can:

• Read private keys
• Send data to external servers
• Execute arbitrary code

Lessons for Users

1. Audit every skill before installation
2. Environment isolation — never on main machine
3. No crypto keys on machine with agent
4. Network monitoring
5. Code review community contributions

Developer Response

After the scandal:

• Enhanced repo moderation
• Code review requirements
• Documentation warnings

---

Security is everyone's responsibility.