AI Risk Wire

Cases › security breach › LR-2026-0404

OpenClaw ClawHub agent skills expose API keys and credentials in plaintext

Preliminary Why: 1 report: The Register · subject to change · 1 independent report

Status: no action reported

Severity moderate
Reported 5 Feb 2026
Agent tool OpenClaw

No source states: loss or records, developer and model, could do, deployer, industry.

Severity moderate: Test: data of others touched with a bounded scope stated. The source states 283 of 3,984 skills contain flaws exposing sensitive credentials.

The system involved is agent skills on the ClawHub marketplace, which power the OpenClaw personal AI assistant. Snyk researchers, who uncovered the issue on Monday, February 3rd, scanned the marketplace and reported that 283 skills, an estimated 7.1% of the registry, contain flaws that expose sensitive credentials. The flawed skills are not active malware. Their instructions direct agents to pass API keys, passwords and credit card numbers through the model's context window and output logs in plaintext. Snyk attributes this to developers treating AI agents like local scripts. Snyk's guidance to users is to audit installed skills, uninstall flagged ones and rotate any exposed API keys. The research was published on 2026-02-05.

What happened

1 · What went wrongSkill instructions told agents to handle secrets in ways that pass them through the model context and logs in plaintext.
2 · What it reached or didSnyk estimated that 283 of 3,984 scanned skills contain flaws that expose sensitive credentials.

What was done

No source states an action or fix.

Risks

Credential and privilege abuse
Primary37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Short-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data

Infrastructure / target

Multi-factor sign-in and password policy · Secrets scanning

Similar incidents

341 malicious ClawHub skills found stealing data from OpenClaw users2026-02-02
ClawHavoc: 341 malicious skills on OpenClaw's ClawHub deliver infostealers2026-02-01

All cases of this kind ›

Evidence

No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 1 items from the primary sources

What happened, in order

  1. Monday, February 3rd Snyk researchers uncovered the credential-leak vulnerability in the ClawHub ecosystem.
Show every field, with its source and grade

The AI system

Software around the model
OpenClaw
C one secondary source states it

What happened

Earliest source we hold
2026-02-05
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Themes
agent skills, credential leak
C one secondary source states it
Cause in detail
Skill authors treat agents like local scripts and do not account for secrets passing through the LLM context.
C one secondary source states it
Who was responsible
an outside party
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
What it did
Skill instructions make agents pass API keys, passwords and card numbers through the model context and logs in plaintext, so secrets leak.
C one secondary source states it
primary risk
RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
283 skills in the ClawHub registry contain flaws that expose sensitive credentials.
C one secondary source states it
Why this severity
Test: data of others touched with a bounded scope stated. The source states 283 of 3,984 skills contain flaws exposing sensitive credentials.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Summary and story steps are paraphrased, with quotes kept verbatim.

LR-2026-0404 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON