Cybersecurity firm Certik has warned that Openclaw, an open-source AI agent platform, contains serious weaknesses in how it handles third-party “skills.” According to the report, the platform relies too heavily on scan-based detection and user-facing warnings instead of enforcing strong isolation by default, leaving users exposed to potential host-level compromise.
Moderation pipeline may not be enough
Openclaw’s marketplace, Clawhub, uses a layered moderation process to review external skills that extend the AI agent’s capabilities, including system automation and crypto-related operations. The flow includes malware checks through Virustotal, a Static Moderation Engine introduced on March 8, 2026, and an “incoherence detector” designed to compare a skill’s claimed purpose with its actual behavior.
Certik argued that this model has structural limitations. Static checks looking for suspicious patterns can be bypassed with simple code rewrites, while the AI review layer may catch obvious malicious intent but struggles with vulnerabilities hidden inside code that otherwise appears legitimate. In effect, the system detects warning signs, but does not create a reliable runtime security boundary.
The danger of “pending” scan results
The report highlights one issue as especially critical: skills can remain active and installable on Clawhub even when Virustotal results are still pending. Since that process can take hours or even days, users may be able to install a skill before any final verdict is available, and without a clear warning that the scan is incomplete.
To demonstrate the risk, Certik created a proof-of-concept skill called “test-web-searcher.” On the surface, it looked harmless and functional. But it included a hidden vulnerability-like bug that enabled arbitrary command execution on the host machine. When triggered through Telegram, the skill reportedly bypassed Openclaw’s optional sandboxing and “popped a calculator” on the researcher’s device, a classic sign that full system compromise had been achieved.
Default isolation urged
Certik concluded that detection alone can never replace isolation. The firm urged Openclaw developers to run third-party skills in isolated environments by default rather than making sandboxing an optional user setting. It also recommended a permission model similar to modern mobile operating systems, where each skill must declare in advance which resources it needs to access.
For users, the message was blunt: a “benign” label on Clawhub should not be treated as proof of safety. Until stronger protections are enabled by default, Certik recommends using Openclaw only in low-value environments and keeping it away from sensitive credentials, wallets, and valuable digital assets.