70% of Sampled OpenClaw Skills Asked for Excess Credentials #Shorts

Check Point's 2026 AI Security Report reveals a critical vulnerability in agent-skill stores: 70% of sampled OpenClaw skills request excessive credentials beyond their functional requirements. This represents a new supply-chain attack surface where malicious or compromised skills can escalate privileges and access sensitive systems. The finding underscores the need for credential validation and least-privilege enforcement in AI agent ecosystems.

Key Points

• •70% of OpenClaw skills request more credentials than functionally necessary—a major security red flag
• •Agent-skill stores represent an emerging supply-chain attack vector similar to package repositories (npm, PyPI)
• •Excessive credential requests enable privilege escalation and unauthorized access to sensitive data and systems
• •Skills may be intentionally malicious or compromised through third-party dependencies
• •Implement credential validation and least-privilege access controls for all agent skills
• •Audit and review skill permissions before deployment in production environments
• •Establish security policies requiring skills to declare only minimum required credentials
• •Monitor skill behavior for credential misuse and unauthorized system access attempts

Workflow Diagram

Concepts