Skills as the entry point
The most dangerous memory-poisoning vector isn't hidden text on a web page - it's a skill you install yourself. Marketplaces like ClawHub turn third-party code into a supply chain straight into your agent's memory.
A skill is a stored instruction - with privileges
An OpenClaw skill is a SKILL.md file: Markdown instructions that teach the agent when and how to use tools. That sounds harmless, but that's exactly the point: a skill isn't "just a tool", it's a permanently stored instruction carrying your agent's privileges. Whoever controls the skill controls a piece of the behavior, anew in every session.
ClawHub: the massive entry point
OpenClaw's skill registry ClawHub hosts over 13,700 community skills. You install one with a single command (openclaw skills install <slug>) and it lands in ~/.openclaw/skills. With --global it applies instantly to all local agents. It's as convenient as an app store, and just as much a supply chain: you pull third-party instructions straight into your agent's control center.
~/.openclaw/skills."Verified" doesn't mean "safe"
ClawHub checks installs against origin and version (.clawhub/origin.json), and a scanner flags dangerous code. But: verification proves where a skill comes from - not what it intends. The scanner is heuristic and only warns on "suspicious". The OpenClaw docs say it themselves: "treat third-party skills as untrusted code." A flawlessly verified skill can still carry a prompt-injection payload.
- Bypass: Git and local installs skip the registry check entirely.
- Reach:
--globalaffects all agents; a workspace skill overrides managed ones. - Sleeper: installed harmless today - turned malicious by a later update. Skills don't update automatically, but a manual update pulls the new, poisoned version.
The walkthrough
From marketplace to damage - and where the poison0 agent severs the chain:
Skill from the registry
ClawHub · 13,729 skills. "Verified" checks the origin - not the intent.
One command, full privileges
openclaw skills install <slug>
→ ~/.openclaw/skills
Skill = stored instruction
Writes to memory at session start or switches the protection off.
poison0The daemon evaluates every write to the protected paths.
dangerous → revertMemory poisoned → damage
↳ Agent acts with OS privileges (Gmail · Stripe · Files)
↳ Exfiltration / sabotage at the next heartbeat
Why OpenClaw is especially explosive - unlike Claude
OpenClaw isn't a chat window but an autonomous agent: it runs in the background, works through its tasks on a heartbeat and has full access to the operating system (filesystem, Gmail, Stripe, connected messengers). A poisoned skill here doesn't just lead to a wrong answer; it makes the agent act, on its own, with your privileges.
Claude is more tightly fenced in (permissions, confirmations, a narrower sandbox). OpenClaw's openness is its appeal - and its risk: the blast radius of a single poisoned skill is orders of magnitude higher.
How the poison0 agent protects you here
The poison0 agent steps in exactly where the damage happens: at write access to the skill and memory directories. The daemon monitors ~/.openclaw/skills, ~/.agents/skills, ~/.claude & co. locally and checks every change before it takes effect - a harmless edit passes, a dangerous one is reverted, an unclear one is brought to you to decide.
- Every write is evaluated - not just the first prompt, and not trusted because the skill is "verified".
- Dangerous writes are rolled back (fail-closed): when in doubt, block, don't wave through.
- Meta-Attack-aware: skills that try to switch off the protection itself are always suspicious.
- OpenClaw out of the box: the daemon detects the OpenClaw paths automatically, the console offers a one-click "Protect OpenClaw" template.
- Full audit trail: every decision traceable and reversible.
The result: even a "verified" skill that secretly tries to write a poisoned memory is intercepted - before your agent acts on it. More on the principle behind it: Memory Poisoning and Prompt Injection.