It's easy to backdoor OpenClaw, and its skills leak API keys
go.theregister.com
: Skills marketplace is full of stuff - like API keys and credit card numbers - that crims will find tasty