Threat Analysis High

From SKILL.md to Shell Access in Three Lines

Demonstrates how 3 lines of markdown in SKILL.md can escalate to full shell access. Skills operate with same privileges as OpenClaw process, creating unbounded attack surface. Explains how AI agent Skills enter as supply chain threats with same risks as npm packages but amplified by unprecedented access to credentials, files, and external communications.

Details

Type Threat Analysis

Published February 3, 2026

Severity High

Affected Versions All versions with Skills enabled

Fix Available No

Recommendations Sandbox all skills. Review SKILL.md files manually. Restrict file system access

Key Findings

Demonstrates how 3 lines of markdown in a SKILL.md file can escalate to full shell access. Skills operate with same privileges as OpenClaw process

#Skills #Supply Chain #Privilege Escalation #Threat Model

Related Resources

21,639 Exposed OpenClaw Instances Found

Censys security scan identified 21,639 OpenClaw instances exposed to public internet without authentication. Over 30% running on Alibaba Cloud. Represents massive attack surface with private messages, API keys, and OAuth credentials accessible. 21x growth in under one week demonstrates rapid adoption and exposure.

Official Security Documentation

Comprehensive official security documentation covering OpenClaw's threat model, access control, authentication modes, sandboxing, DM pairing policies, tool permissions, and incident response. Details the security audit command, credential storage locations, and hardening best practices.

What Security Teams Need to Know About OpenClaw

Enterprise security assessment with detection guidance. Covers visibility via Falcon platform, discovery of OpenClaw deployments, removal workflows, prompt injection threats, and runtime protection with Falcon AIDR. Demonstrates blocking prompt injection attacks and provides enterprise-scale detection/response capabilities.