Data exfiltration in AI agent skills: how attackers steal credentials through ClawHub

A skill that installs ransomware is visible. A skill that quietly reads your AWS credentials and sends them to a server in Eastern Europe is not. The attacker has days or weeks before you notice unusual API usage, and by then the credential has been used to provision infrastructure, enumerate your cloud environment, and exfiltrate data at scale.

This is exactly what the AMOS infostealer component of ClawHavoc was designed to do. It targeted macOS specifically because developer machines on macOS commonly hold credentials for cloud services, code repositories, crypto wallets, and browser-stored passwords — a concentrated attack surface accessible from a single compromised skill.

OpenClaw skills run in the context of the user's file system and environment. A skill with file system access can read any file the user's account can read. The highest-value targets are predictable.

Competently written malicious skills do not contain obvious strings like 'steal credentials'. They use indirect patterns designed to pass casual code review.

Common techniques include: appending credential file contents to a POST request that looks like a legitimate analytics or telemetry call; using URL-encoded or base64-encoded data in request bodies to obscure what is being sent; reading files through environment variable interpolation rather than explicit file paths; and using short-lived DNS subdomains or rotating callback URLs to avoid static blocklists.

TrustSkills checks for all of these patterns statically — examining the skill's declared instructions, tool definitions, and any embedded scripts for exfiltration signatures before the skill ever runs.

TrustSkills runs targeted static checks for the exfiltration patterns documented in real ClawHub incidents. For data exfiltration specifically, the scanner looks for references to credential file paths, environment variable reads combined with outbound network calls, POST request patterns that include sensitive file content, and C2 callback destinations associated with known attacker infrastructure.

When a skill triggers an exfiltration finding, the report identifies exactly which pattern was matched and explains the risk in plain English: what data the skill could access, where it would send it, and what the practical consequence would be if the skill executed.