AMOS Delivery via ClawHub OpenClaw Skill - Credential & Wallet Access

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.