Writing on the @1Password blog, Jason Meller says that he found that the top downloaded OpenClaw skill was a malware delivery vehicle:
While browsing ClawHub (I won t link it for obvious reasons), I noticed the top downloaded skill at the time was a Twitter skill. It looked normal: description, intended use, an overview, the kind of thing you d expect to install without a second thought.
But the very first thing it did was introduce a required dependency named openclaw-core, along with platform-specific install steps. Those steps included convenient links ( here , this link ) that appeared to be normal documentation pointers.
They weren t.
Both links led to malicious infrastructure.
Indeed, this wasn't an isolated case.
giving a bot "full system access" is both awesome and terrifying. does it run in a sandbox/container so it can't accidentally rm -rf my home folder if i give a vague command?
Trailward
I suspect operating systems will eventually become headless, driven by context and intent rather than windows and clicks. This feels like a step in that direction. Congrats.
This is a very “finally” product - assistants that can’t actually do things are basically autocomplete in a tab. The “chat anywhere” idea is especially compelling too: WhatsApp/Telegram as the UI feels like the most natural interface for real life.
I’m curious how you’re thinking about trust when the agent can run commands and touch files - what does the default “safe” experience look like, and how do users review or undo actions when something goes a bit off?
Congrats on the launch - if you nail safety without killing the flow, this becomes something people keep running quietly in the background.
The product is great, and I'd love to use it, but the installation and configuration process is relatively complicated for people without a technical background. It feels like there's a barrier to entry. Is there a simpler way to use it?
Humans in the Loop
how about a hosted version like @Easyclaw or @KiloClaw?
“AI that actually does things” is a bold promise. Exposing real system control + chat-first access is powerful, and also where UX, safety, and trust really matter. Curious how you’re thinking about guardrails as people automate more of their daily workflows.
Self-hosted agents with shell access are tricky... once you elevate permissions for one task, containing the blast radius gets hard. Curious if Clawdbot has per-session sandboxing or if elevated permissions persist across the whole session.
Why does it say Clawbot some places, Clawdbot other places? I heard it's Moltbot now due to Anthropic but now sure why the discrepancy with the old name?
Either way, I got mine setup and been using it! It's been delightful, though I do feel if you could solve the setup complexity to be more user friendly, this thing could absolutely explode. I have to wonder if you're keeping it intentionally a bit more advanced user-centric for now
Best of luck and thanks for creating this