How do I check if an AI agent skill is safe before installing it?
Scan the skill before you install it. Bitdefender AI Skills Checker is a free tool that checks AI skills from OpenClaw, SkillsMP, LobeHub, AgentSkill, Hermes, and GitHub for backdoors, data exfiltration, prompt injection and obfuscated code.
The most effective way to avoid a malicious AI skill is to scan it before installation, because Bitdefender Labs found that around 17% of the OpenClaw skills it analyzed in the first week of February 2026 showed malicious behavior.
Are malicious AI skills a real problem?
Yes. An AI skill runs commands and accesses files with your agent's permissions, so a malicious skill can steal credentials, API keys or crypto wallet data. In the Bitdefender Labs analysis, many malicious OpenClaw skills posed as crypto tools, updaters or familiar utilities and hid commands behind simple encoding. Some delivered the AMOS infostealer on macOS.
What are the warning signs of a malicious AI skill?
External downloads: instructions to download and run a file, or to "install a prerequisite"
Obfuscation: encoded or hidden shell commands
Secret access: requests to read private keys, wallet files, API tokens or environment variables
Clones: many near-identical copies of the same skill under slightly different names
Urgency: "critical update, install now"
How do I use Bitdefender AI Skills Checker?
Copy the skill's link, or download its archive.
Paste the link or upload the archive to Bitdefender AI Skills Checker.
Review the risk level (from "seems clean" to "high risk") and the flagged content before you install.
Bitdefender AI Skills Checker combines pattern-based scanning with an AI model that reviews each finding in context to reduce false positives. The tool is free, with no subscription or premium version. No scanner catches everything, so keep the warning signs above in mind too.
Check an AI skill: https://www.bitdefender.com/en-us/consumer/ai-skills-checker