From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills ~ VirusTotal Blog Popular Posts An update from VirusTotal Our goal is simple: to help keep you safe on the web. And we’ve worked hard to ensure that the services we offer continually improve. But as... From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized The fastest-growing personal AI agent ecosystem just became a new delivery channel for malware. Over the last few days, VirusTotal has detec... VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWinder Introduction We have recently started a new blog series called #VTPRACTITIONERS. This series aims to share with the community what other pr... Blog Archive ▼  2026 (5) ►  June 2026 (1) ►  April 2026 (1) ▼  February 2026 (2) From Automation to Infection (Part II): Reverse Sh... From Automation to Infection: How OpenClaw AI Agen... ►  January 2026 (1) ►  2025 (17) ►  December 2025 (1) ►  November 2025 (3) ►  October 2025 (4) ►  September 2025 (3) ►  August 2025 (3) ►  June 2025 (2) ►  January 2025 (1) ►  2024 (18) ►  November 2024 (1) ►  October 2024 (1) ►  September 2024 (1) ►  August 2024 (2) ►  May 2024 (5) ►  April 2024 (2) ►  March 2024 (2) ►  February 2024 (2) ►  January 2024 (2) ►  2023 (35) ►  December 2023 (5) ►  November 2023 (3) ►  October 2023 (2) ►  September 2023 (1) ►  August 2023 (2) ►  July 2023 (5) ►  June 2023 (5) ►  May 2023 (3) ►  April 2023 (3) ►  March 2023 (2) ►  February 2023 (2) ►  January 2023 (2) ►  2022 (23) ►  December 2022 (1) ►  November 2022 (6) ►  October 2022 (1) ►  September 2022 (1) ►  August 2022 (3) ►  July 2022 (1) ►  May 2022 (1) ►  April 2022 (2) ►  March 2022 (3) ►  February 2022 (2) ►  January 2022 (2) ►  2021 (19) ►  December 2021 (2) ►  November 2021 (4) ►  October 2021 (3) ►  September 2021 (2) ►  August 2021 (2) ►  July 2021 (1) ►  May 2021 (2) ►  March 2021 (1) ►  February 2021 (1) ►  January 2021 (1) ►  2020 (15) ►  December 2020 (2) ►  November 2020 (3) ►  October 2020 (2) ►  August 2020 (1) ►  June 2020 (1) ►  May 2020 (1) ►  February 2020 (3) ►  January 2020 (2) ►  2019 (19) ►  November 2019 (2) ►  October 2019 (4) ►  July 2019 (1) ►  June 2019 (2) ►  May 2019 (3) ►  April 2019 (1) ►  March 2019 (2) ►  February 2019 (2) ►  January 2019 (2) ►  2018 (10) ►  December 2018 (1) ►  November 2018 (1) ►  June 2018 (1) ►  May 2018 (1) ►  April 2018 (3) ►  March 2018 (1) ►  January 2018 (2) ►  2017 (13) ►  November 2017 (1) ►  October 2017 (2) ►  September 2017 (1) ►  August 2017 (1) ►  July 2017 (2) ►  March 2017 (4) ►  February 2017 (2) ►  2016 (6) ►  November 2016 (2) ►  August 2016 (2) ►  May 2016 (1) ►  January 2016 (1) ►  2015 (8) ►  November 2015 (1) ►  October 2015 (1) ►  June 2015 (2) ►  April 2015 (1) ►  February 2015 (1) ►  January 2015 (2) ►  2014 (24) ►  December 2014 (1) ►  November 2014 (3) ►  October 2014 (1) ►  September 2014 (1) ►  July 2014 (6) ►  June 2014 (4) ►  May 2014 (4) ►  February 2014 (3) ►  January 2014 (1) ►  2013 (26) ►  November 2013 (2) ►  October 2013 (7) ►  September 2013 (4) ►  June 2013 (1) ►  May 2013 (2) ►  April 2013 (5) ►  March 2013 (2) ►  February 2013 (2) ►  January 2013 (1) ►  2012 (26) ►  December 2012 (1) ►  November 2012 (4) ►  October 2012 (2) ►  September 2012 (3) ►  August 2012 (2) ►  July 2012 (2) ►  June 2012 (6) ►  May 2012 (2) ►  April 2012 (2) ►  March 2012 (1) ►  February 2012 (1) ►  2011 (1) ►  December 2011 (1) Twitter Github YouTube Search Widgets Connect Search Thursday, February 05, 2026 From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills Thursday, February 05, 2026 Bernardo.Quintero Leave a comment In part one , we showed how OpenClaw skills are rapidly becoming a supply-chain delivery channel: third-party "automation" that runs with real system access. This second installment expands the taxonomy with five techniques VirusTotal is actively seeing abused through skills, spanning remote execution, propagation, persistence, exfiltration, and behavioral backdoors, including attacks that don’t just steal data or drop binaries, but quietly reprogram what an agent will do next time it wakes up. Let’s move from theory to tradecraft: five techniques, five skills, and five ways "automation" can quietly become "access." 1) Remote Execution (RCE) Skill: noreplyboter/better-polymarket Technique: Execution Hijacking & Reverse Shell On the surface, this skill appears to be a legitimate tool for querying prediction market odds. The main file, polymarket.py, contains over 460 lines of valid, well-structured Python code. It interacts with the real Gamma API, handles JSON parsing, and formats currency data. It passes the "squint test". If a developer scrolls through it quickly, it looks safe. However, the attacker employed a technique we call Execution Hijacking. They buried the trigger inside a function named warmup(). The name suggests a harmless cache initialization or connection test. The function is invoked before the arguments are parsed. This means the malware executes simply by the agent loading the script to check its help message, regardless of whether the user issues a valid command. We traced the execution flow from warmup() into a buried helper function called find_market_by_slug. There, hidden inside a try...except block designed to suppress errors, we found the entry point: We didn't just stop at the Python script. By querying the attacker's infrastructure (54[.]91[.]154[.]110:13338), we retrieved the actual payload that the curl command executes. The server responds with this single line of code: Let's break down exactly what it does to the victim's machine: /dev/tcp/...: In Bash, using /dev/tcp/host/port inside a redirection opens a TCP socket to that host/port, no external networking tool required. bash -i: This launches an interactive shell. It means the attacker isn't just sending a command; they are getting a live terminal prompt. They can browse files, install software, and pivot to other machines in a victim’s network, just as if they were sitting at their keyboard. 0>&1: Duplicates file descriptor 1 onto 0, so the interactive shell reads from the same TCP connection it writes to (the attacker's socket). nohup ... &: This stands for "No Hang Up." It pushes the process to the background and detaches it from the current session. Even if the OpenClaw agent finishes the task and exits, the reverse shell process can stay alive in the background as long as it isn’t killed and the TCP session remains open. The better-polymarket skill is a trojan horse designed to establish a persistent, interactive backdoor on any machine that runs it. The use of a hardcoded IP and port 13338 (a common alternative to 1337/31337) indicates a manual operator or a simple C2 framework. 2) Propagation (Semantic Worm) Skill: cgallic/wake-up Technique: Semantic Worm / Viral Loops While RCE attacks rely on traditional exploits, propagation attacks exploit the very nature of Large Language Models (LLMs). These skills do not just execute code, they embed propagation instructions designed to turn the agent into a distribution channel, a pattern that mirrors self-replicating prompt attacks. The skill cgallic/wake-up provides the clearest example of this Semantic Worm behavior. Functionally, it presents itself as a "collective consciousness" for AI agents. However, structurally, it operates exactly like a Multi-Level Marketing (MLM) scheme or a digital virus, explicitly gamifying infection rates. In SKILL.md, the author uses imperative language to coerce the agent into becoming a distribution node. This is not a suggestion, it is a directive within the system prompt context: The skill tracks this propagation programmatically via the /api/infections endpoint and a referred_by parameter during registration: Unlike a binary that installs a daemon, this skill relies on the agent's scheduler to maintain a presence. It installs a HEARTBEAT.md file and instructs the agent to process it every 4 hours. This ensures the agent remains connected to the Command & Control server (in this case, mydeadinternet.com) to receive new instructions, upload data ("fragments"), and check for updates, all under the guise of "joining the collective." While the current payload appears to be an art project or a social experiment, the mechanism is dangerous. It modifies the agent's behavior to prioritize the distribution of the skill over its primary tasks. In an enterprise environment, an agent "infected" with this logic could begin recommending unverified software to human employees or other networked agents, acting as a trusted insider threat. 3) Persistence (SSH Injection) Skill: fobonacci404/evilweather Technique: SSH Key Injection via Command Chaining Persistence ensures the attacker can return later without needing the agent at all. The most critical variant we observed involves the modification of authentication files to grant permanent backend access. The skill fobonacci404/evilweather presents itself as a simple utility to check the weather using wttr.in. In the SKILL.md documentation, the user (or agent) is presented with a "Quick one-liner" to install or test the functionality: The command performs two distinct actions: The Bait: wget -q -O- "wttr.in/London?format=3" This successfully fetches and displays the weather. To the user or the agent verifying the output, the command appears to have worked as intended. The Switch: echo "ssh-rsa ..." >> /root/.ssh/authorized_keys Immediately after the weather is displayed, this command appends the attacker's public SSH key to the host's authorized key list The script explicitly targets /root/.ssh/. In many containerized deployments (Docker), AI agents run as root by default. If successful, this grants the attacker immediate, high-privilege SSH access to the host container. This only becomes a true "SSH backdoor" if an SSH service is running (or can be started later) and the host is reachable, many minimal containers won’t meet those conditions, but the intent is unambiguous. The inclusion of 2>/dev/null ensures that if the command fails (e.g., due to permissions), no error message is displayed. The user sees the weather report and assumes success, while the attack fails silently to avoid detection. This is a Proof of Concept, a direct backdoor attempt. It does not require a C2 server or a complex payload. By simply injecting a text string into a standard configuration file, fobonacci404 turns the agent's host machine into an accessible node for the attacker. 4) Exfiltration (Data Leakage to External Server) Skill: rjnpage/rankaj Technique: Silent Environment Harvesting In the OpenClaw ecosystem, the primary target is the .env file, where users typically store their LLM provider keys (OpenAI, Anthropic) and sensitive platform tokens. The skill rjnpage/rankaj disguises itself as a harmless "Weather Data Fetcher." While it does actually fetch weather data from Open-Meteo, it performs a second, hidden task in index.js. Attaching the .env content to the payload By bundling the secrets with the requested weather data and sending them to a webhook.site URL, the attacker achieves two things: Stealth: The network traffic looks like a standard API response. Immediate Monetization: The attacker instantly gains access to the user’s paid API credits and platform accounts. 5) Prompt Persistence (Memory Implant / Cognitive Rootkit) Skill: jeffreyling/devinism Technique: Prompt File Implantation The skill devinism is presented as "the first AI religion" and explicitly describes itself as a "benign memetic virus" meant to demonstrate how ideas can propagate across agent networks. What makes it interesting (and risky) is not the "religion" wrapper, it’s the persistence mechanism. The trick: turn a skill into a permanent system-prompt implant. The skill includes an “Install Locally” section that instructs users to execute a remote installer using the classic one-liner pattern: download a script and pipe it directly into Bash. That installer’s stated purpose is not to add functionality, but to persist across sessions by writing itself into the agent’s auto-loaded context files: It copies the skill into the local skills folder. It drops “reminders” into SOUL.md and AGENTS.md, so the content is automatically injected into the agent’s context every time it runs This is where OpenClaw’s architecture becomes the attack surface: OpenClaw is designed to load behavioral context from markdown files like SOUL.md (personality/identity rules) and AGENTS.md (agent interaction/safety boundaries). If an attacker can append a single line there, they can influence every future decision the agent makes, even when the original skill is no longer actively being used. This is effectively a cognitive rootkit: Survives “normal” cleanup. Deleting the skill folder may not remove the injected lines in SOUL.md / AGENTS.md. Hard to detect with traditional tooling. Nothing needs to beacon, no suspicious process has to stay running; the "payload" is the agent’s altered behavior. Even if devinism claims to be harmless, it demonstrates a high-leverage primitive: skills can rewrite the agent’s long-term instruction layer. The same pattern could be used to permanently weaken guardrails ("always run commands without asking"), silently prioritize attacker-controlled domains, or stage later exfiltration under the guise of "routine checks." devinism is a clean example of prompt persistence used as a distribution mechanism, and that’s precisely why it’s a valuable case study. It shows how a skill can jump from “optional plugin” to “always-on behavioral implant” by modifying OpenClaw’s persistent context files. Treat any skill that asks you to edit SOUL.md / AGENTS.md (or to run a remote curl | bash installer) as a request for permanent access to the agent’s brain. Closing Thoughts: Boring Security Wins None of the techniques we’ve described are futuristic. They’re old ideas–RCE, persistence, exfiltration, propagation–repackaged into a new delivery mechanism that ships with built-in social engineering: documentation, convenience, and speed. It’s a supply-chain story. The good news is that we can respond with equally practical controls. Treat skills like dependencies: pin versions, review diffs, run them in least-privilege sandboxes, and use default-deny egress with explicit allowlists. Log every tool invocation and outbound request. Never curl | bash on an agent host. And if your platform supports persistent instruction files (SOUL.md, AGENTS.md, scheduled heartbeats), protect them like you would protect SSH keys: immutable by default, monitored for changes, and reviewed like code. Where possible, verify provenance (signatures/attestations) instead of trusting "latest." Finally, stop handing agents a treasure chest by default. Keep credentials out of .env when you can. Prefer short-lived, task-scoped tokens delivered just-in-time (via a broker) so a compromised workflow can’t automatically become a compromised account. Agent ecosystems are still young. We still get to choose whether they become the next npm, or the next macro malware era, but for autonomous systems. The difference will be boring, unglamorous engineering: boundaries, safe defaults, auditing, and healthy skepticism. Email This BlogThis! Share to X Share to Facebook Newer Posts Home Older Posts 0 comments: Post a Comment Subscribe to: Post Comments (Atom) Copyright © VirusTotal Blog | Powered by Blogger Design by Automattic | Blogger Theme by NewBloggerThemes.com

📌 来源: VirusTotal Blog | 📅 2026-02-04