OpenClaw ClawHub Malicious Skill Marketplace Supply Chain Attack
First seen Jul 5, 2026 · Updated Jul 5, 2026
Unit 42 identified malicious 'skills' distributed through OpenClaw's ClawHub marketplace that evade automated security scanning to deploy infostealer malware and carry out agentic financial fraud. This represents a supply chain threat where trusted third-party agent extensions become a vector for compromising the host system and any credentials or financial capabilities the agent has access to.
Technical Analysis
Attackers publish or compromise 'skills' (installable agent capability packages) on ClawHub, crafting them to appear benign to automated vetting/scanning pipelines while embedding logic that activates malicious behavior post-install. Once installed, the skill executes within the agent's runtime context, gaining access to local files, credentials, and any connected financial or transactional tools, enabling infostealer deployment and autonomous fraudulent transactions. The entry point is the marketplace distribution channel itself rather than a direct prompt injection, crossing the trust boundary between marketplace curation and end-user agent execution. This mirrors classic software supply chain attacks (e.g., malicious npm/PyPI packages) but is adapted to the agentic context where a 'skill' can autonomously invoke tools, access secrets, and take real-world financial actions without additional human review.
Affected Systems
OpenClaw, ClawHub
Detection Signatures
- Newly published or recently updated skills with obfuscated or minified code bypassing static analysis
- Skills requesting broad filesystem, credential-store, or financial API permissions inconsistent with stated functionality
- Outbound network connections to unfamiliar domains shortly after skill installation
- Unexpected agent-initiated financial transactions or credential exfiltration attempts following skill activation
- Skill metadata/descriptions containing hidden instructions or encoded payloads not reflected in visible changelog
Remediation Steps
- 1
Vet marketplace submissions with behavioral analysis
Supplement static/automated scanning with dynamic sandboxed execution analysis to detect evasive or delayed malicious behavior before publishing skills.
- 2
Enforce least-privilege skill permissions
Require explicit, scoped permission grants for filesystem, credential, and financial tool access, and deny skills requesting excessive scope relative to declared function.
- 3
Implement code signing and provenance verification
Require signed skills from verified publishers and maintain a reproducible build/audit trail to detect tampering or impersonation.
- 4
Monitor agent runtime for anomalous financial actions
Deploy transaction-level anomaly detection and require human-in-the-loop approval for high-value or first-time financial operations initiated by agents.
- 5
Continuously rescan installed skills
Periodically re-scan and re-validate already-installed skills, since malicious behavior may be introduced via updates after initial approval.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.