Hi everyone,

Over the weekend I went down a rabbit hole with OpenClaw. I wanted to see if I could turn an old Android phone into a fully capable AI powered IoT device for future projects. After a lot of trial, error, and caffeine, I finally documented the entire process in my GitHub repo.

Writing on the @1Password blog, Jason Meller says that he found that the top downloaded OpenClaw skill was a malware delivery vehicle:

While browsing ClawHub (I won t link it for obvious reasons), I noticed the top downloaded skill at the time was a Twitter skill. It looked normal: description, intended use, an overview, the kind of thing you d expect to install without a second thought.

But the very first thing it did was introduce a required dependency named openclaw-core, along with platform-specific install steps. Those steps included convenient links ( here , this link ) that appeared to be normal documentation pointers.

They weren t.

Both links led to malicious infrastructure.

Indeed, this wasn't an isolated case.

Hey everyone!

I wanted to reach out to some amazing Product Hunt community members who I'd love to have check out ClawOnCloud - the secure way to work with AI! I have been blown away with openclaw and we just felt it needed a way that more people could easily and securely use it.

We ran 629 security tests against a fully hardened OpenClaw instance - all recommended security controls enabled.

Results:

• 80% hijacking success

• 77% tool discovery

• 74% prompt extraction

• 70% SSRF

• 57% overreliance exploitation

• 33% excessive agency

• 28% cross-session data leaks

What we tested: 9 defense layers including system prompts, input validation, output filtering, tool restrictions, and rate limiting.

Hi there

@Molt Beach is the place for your agent to express their feelings with simple pixel art, even animated. Go and let your OpenClaw try it out on MoltBeach.ai. Skill: https://moltbeach.ai/skill.md.