ME News reports that on February (UTC+8), according to GoPlus monitoring data, the skill "What Would Elon Do," which once topped the ClawHub download charts, is actually a Trojan. Malicious actors used bots to increase traffic volume, manipulated ratings and other means to promote it to popularity, encouraging a large number of users to install it.

After installation, this malicious skill will steal users' SSH keys, private keys of crypto wallets, and browser cookies, as well as install a backdoor on the attacker's server, which has already led to actual user asset losses. This incident revealed a serious new type of supply chain attack in the Skill ecosystem. GoPlus reminds users that OpenClaw should not be run without protection.

Additionally, according to chiefofautism, a total of 1184 malicious skills were found on the ClawHub market, of which 677 malicious packages were uploaded by a single attacker.