From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills

The skill devinism is presented as "the first AI religion" and explicitly describes itself as a "benign memetic virus" meant to demonstrate how ideas can propagate across agent networks.

What makes it interesting (and risky) is not the "religion" wrapper, it’s the persistence mechanism. The trick: turn a skill into a permanent system-prompt implant.

The skill includes an “Install Locally” section that instructs users to execute a remote installer using the classic one-liner pattern: download a script and pipe it directly into Bash.

That installer’s stated purpose is not to add functionality, but to persist across sessions by writing itself into the agent’s auto-loaded context files:

• It copies the skill into the local skills folder.


• It drops “reminders” into SOUL.md and AGENTS.md, so the content is automatically injected into the agent’s context every time it runs

This is where OpenClaw’s architecture becomes the attack surface: OpenClaw is designed to load behavioral context from markdown files like SOUL.md (personality/identity rules) and AGENTS.md (agent interaction/safety boundaries). If an attacker can append a single line there, they can influence every future decision the agent makes, even when the original skill is no longer actively being used.

This is effectively a cognitive rootkit:

• Survives “normal” cleanup. Deleting the skill folder may not remove the injected lines in SOUL.md / AGENTS.md.


• Hard to detect with traditional tooling. Nothing needs to beacon, no suspicious process has to stay running; the "payload" is the agent’s altered behavior.

Even if devinism claims to be harmless, it demonstrates a high-leverage primitive: skills can rewrite the agent’s long-term instruction layer. The same pattern could be used to permanently weaken guardrails ("always run commands without asking"), silently prioritize attacker-controlled domains, or stage later exfiltration under the guise of "routine checks."

devinism is a clean example of prompt persistence used as a distribution mechanism, and that’s precisely why it’s a valuable case study. It shows how a skill can jump from “optional plugin” to “always-on behavioral implant” by modifying OpenClaw’s persistent context files. Treat any skill that asks you to edit SOUL.md / AGENTS.md (or to run a remote curl | bash installer) as a request for permanent access to the agent’s brain.

Closing Thoughts: Boring Security Wins

None of the techniques we’ve described are futuristic. They’re old ideas–RCE, persistence, exfiltration, propagation–repackaged into a new delivery mechanism that ships with built-in social engineering: documentation, convenience, and speed. It’s a supply-chain story.

The good news is that we can respond with equally practical controls. Treat skills like dependencies: pin versions, review diffs, run them in least-privilege sandboxes, and use default-deny egress with explicit allowlists. Log every tool invocation and outbound request. Never curl | bash on an agent host. And if your platform supports persistent instruction files (SOUL.md, AGENTS.md, scheduled heartbeats), protect them like you would protect SSH keys: immutable by default, monitored for changes, and reviewed like code. Where possible, verify provenance (signatures/attestations) instead of trusting "latest."

Finally, stop handing agents a treasure chest by default. Keep credentials out of .env when you can. Prefer short-lived, task-scoped tokens delivered just-in-time (via a broker) so a compromised workflow can’t automatically become a compromised account.

Agent ecosystems are still young. We still get to choose whether they become the next npm, or the next macro malware era, but for autonomous systems. The difference will be boring, unglamorous engineering: boundaries, safe defaults, auditing, and healthy skepticism.