{"schema_version":"0.10.0","id":"LR-2026-0404","record_version":1,"title":"OpenClaw ClawHub agent skills expose API keys and credentials in plaintext","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Register · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Register · subject to change"}]},"sources_hash":"4a2194856fbe9ff644f2e6304d1b75128fd5ff4962d1856619fdf20d15e1efaa"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"OpenClaw","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-05","incident_class":"security_compromise","failure_class":"data_exfiltration","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"The system involved is agent skills on the ClawHub marketplace, which power the OpenClaw personal AI assistant. Snyk researchers, who uncovered the issue on Monday, February 3rd, scanned the marketplace and reported that 283 skills, an estimated 7.1% of the registry, contain flaws that expose sensitive credentials. The flawed skills are not active malware. Their instructions direct agents to pass API keys, passwords and credit card numbers through the model's context window and output logs in plaintext. Snyk attributes this to developers treating AI agents like local scripts. Snyk's guidance to users is to audit installed skills, uninstall flagged ones and rotate any exposed API keys. The research was published on 2026-02-05.","tags":["agent-skills","credential-leak"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Skill authors treat agents like local scripts and do not account for secrets passing through the LLM context.","failure_class_detail":"Skill instructions make agents pass API keys, passwords and card numbers through the model context and logs in plaintext, so secrets leak.","responsible_party":"third_party","adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with a bounded scope stated. The source states 283 of 3,984 skills contain flaws exposing sensitive credentials.","harm_class":[],"affected_description":"283 skills in the ClawHub registry contain flaws that expose sensitive credentials.","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.theregister.com/security/2026/02/05/its-easy-to-backdoor-openclaw-and-its-skills-leak-api-keys/4692118","publisher":"The Register","date":"2026-02-05","type":"press","title":"It's easy to backdoor OpenClaw, and its skills leak API keys - The Register","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://snyk.io/blog/openclaw-skills-credential-leaks-research/","publisher":"Snyk","date":"2026-02-05","type":"press","title":"280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII - Snyk","archived_url":null}],"per_field_confidence":{"system.harness":"C","event.agent_involved":"C","event.failure_class":"C","event.failure_class_detail":"C","event.detection_method":"C","event.root_cause_detail":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.date_disclosed":"C","event.tags":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":1,"quote":"These agent skills are what largely power the magic of the OpenClaw personal AI assistant project."}],"event.agent_involved":[{"source_index":1,"quote":"They are functional, popular agent skills (like moltyverse-email and youtube-data) that instruct AI agents to mishandle secrets, forcing them to pass API keys, passwords, and even credit card numbers through the LLM’s context window and output logs in plaintext."}],"event.failure_class":[{"source_index":1,"quote":"In the \"AI World,\" an instruction telling an LLM to handle an API key is an active exfiltration channel."}],"event.failure_class_detail":[{"source_index":1,"quote":"They are functional, popular agent skills (like moltyverse-email and youtube-data) that instruct AI agents to mishandle secrets, forcing them to pass API keys, passwords, and even credit card numbers through the LLM’s context window and output logs in plaintext."}],"event.detection_method":[{"source_index":1,"quote":"On Monday, February 3rd, Snyk Staff Senior Engineer Luca Beurer-Kellner and Senior Incubation Engineer Hemang Sarkar uncovered a massive systemic vulnerability in the ClawHub ecosystem (clawhub.ai)."}],"event.root_cause_detail":[{"source_index":1,"quote":"Developers are treating AI agents like local scripts, forgetting that every piece of data an agent touches \"passes through\" the Large Language Model (LLM)."}],"event.responsible_party":[{"source_index":1,"quote":"Developers are treating AI agents like local scripts, forgetting that every piece of data an agent touches \"passes through\" the Large Language Model (LLM)."}],"event.adversarial_actor":[{"source_index":1,"quote":"These are not active malware."}],"event.date_disclosed":[{"source_index":1,"quote":"February 5, 2026"}],"event.tags":[{"source_index":1,"quote":"They are functional, popular agent skills (like moltyverse-email and youtube-data) that instruct AI agents to mishandle secrets, forcing them to pass API keys, passwords, and even credit card numbers through the LLM’s context window and output logs in plaintext."}],"impact.affected_description":[{"source_index":1,"quote":"Scanning the entire ClawHub marketplace (3,984 skills) using Evo Agent Security Analyzer, our researchers found that 283 skills, an estimated 7.1% of the entire registry, contain critical security flaws that expose sensitive credentials."}],"event.incident_class":[{"source_index":1,"quote":"On Monday, February 3rd, Snyk Staff Senior Engineer Luca Beurer-Kellner and Senior Incubation Engineer Hemang Sarkar uncovered a massive systemic vulnerability in the ClawHub ecosystem (clawhub.ai)."}],"impact.severity":[{"source_index":1,"quote":"Scanning the entire ClawHub marketplace (3,984 skills) using Evo Agent Security Analyzer, our researchers found that 283 skills, an estimated 7.1% of the entire registry, contain critical security flaws that expose sensitive credentials."}],"impact.severity_because":[{"source_index":1,"quote":"Scanning the entire ClawHub marketplace (3,984 skills) using Evo Agent Security Analyzer, our researchers found that 283 skills, an estimated 7.1% of the entire registry, contain critical security flaws that expose sensitive credentials."}],"event.summary":[{"source_index":1,"quote":"On Monday, February 3rd, Snyk Staff Senior Engineer Luca Beurer-Kellner and Senior Incubation Engineer Hemang Sarkar uncovered a massive systemic vulnerability in the ClawHub ecosystem (clawhub.ai)."},{"source_index":1,"quote":"Scanning the entire ClawHub marketplace (3,984 skills) using Evo Agent Security Analyzer, our researchers found that 283 skills, an estimated 7.1% of the entire registry, contain critical security flaws that expose sensitive credentials."},{"source_index":1,"quote":"These are not active malware."},{"source_index":1,"quote":"They are functional, popular agent skills (like moltyverse-email and youtube-data) that instruct AI agents to mishandle secrets, forcing them to pass API keys, passwords, and even credit card numbers through the LLM’s context window and output logs in plaintext."},{"source_index":1,"quote":"Developers are treating AI agents like local scripts, forgetting that every piece of data an agent touches \"passes through\" the Large Language Model (LLM)."},{"source_index":1,"quote":"Rotate credentials: If you have used these skills, rotate the associated API keys and monitor for suspicious usage."}]},"notes_on_gaps":"Source 1 is Snyk's own research write-up; it describes skill designs that expose secrets, not a single observed production incident. No model, deployer, lifecycle stage, date of occurrence or exposure count of real users is stated. Snyk's 'Monday, February 3rd' has no year, so date_detected was not set. Source 0 (The Register) gives only a list of headlines and no body text on this incident, so it was not used. Judgements: incident_class set to security_compromise and failure_class to data_exfiltration because the sources describe credential exfiltration channels; root_cause set to integration and responsible_party to third_party from the developer-practice sentence; adversarial_actor set to none because Snyk says the skills are not active malware; severity set to moderate on the bounded 283-skill scope; A4 marked failed from the skill instructions. Summary and story steps are paraphrased, with quotes kept verbatim. Impact counts of affected parties, direct loss and records exposed are not stated and were left out. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Register · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Skill instructions told agents to handle secrets in ways that pass them through the model context and logs in plaintext.","quote":"They are functional, popular agent skills (like moltyverse-email and youtube-data) that instruct AI agents to mishandle secrets, forcing them to pass API keys, passwords, and even credit card numbers through the LLM’s context window and output logs in plaintext.","source_index":1,"grade":"C"},{"step":"reached","text":"Snyk estimated that 283 of 3,984 scanned skills contain flaws that expose sensitive credentials.","quote":"Scanning the entire ClawHub marketplace (3,984 skills) using Evo Agent Security Analyzer, our researchers found that 283 skills, an estimated 7.1% of the entire registry, contain critical security flaws that expose sensitive credentials.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.theregister.com/security/2026/02/05/its-easy-to-backdoor-openclaw-and-its-skills-leak-api-keys/4692118","https://snyk.io/blog/openclaw-skills-credential-leaks-research/"]},"analysis":{"sections":{"timeline":[{"text":"Snyk researchers uncovered the credential-leak vulnerability in the ClawHub ecosystem.","quote":"On Monday, February 3rd, Snyk Staff Senior Engineer Luca Beurer-Kellner and Senior Incubation Engineer Hemang Sarkar uncovered a massive systemic vulnerability in the ClawHub ecosystem (clawhub.ai).","source_index":1,"when":"Monday, February 3rd"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.theregister.com/security/2026/02/05/its-easy-to-backdoor-openclaw-and-its-skills-leak-api-keys/4692118","https://snyk.io/blog/openclaw-skills-credential-leaks-research/"]}}