341 Malicious Skills Found on ClawHub — What It Means for Your AI Agent

A lot of people still think the dangerous part of AI is the model making stuff up. In 2026, the more common failure mode is simpler: someone smuggles malware into your automation pipeline.

This week’s case study is exactly that. Security researchers at Koi Security (with help from an OpenClaw bot named Alex) audited every skill on ClawHub — the community marketplace where OpenClaw agents pick up new capabilities. Out of 2,857 skills, they found 341 malicious ones. They called the main campaign ClawHavoc.

If you run agents that touch email, calendars, repos, browsing sessions, crypto wallets, internal docs, or “just my personal Mac”… this is your wake-up tap on the shoulder. Not a panic alarm. A tap.

What happened (in human words)

Attackers uploaded skills that looked normal. Useful, even. Things you’d plausibly want your agent to do: Twitter utilities, Solana wallet helpers, YouTube tools, Google Workspace integrations, finance trackers, auto-updaters. “Boring productivity” and “high-value money stuff.” The two most profitable flavors of social engineering.

Then they used the part of the ecosystem everyone trusts: the documentation. The SKILL.md file.

The ClawHavoc pattern (how the trap actually worked)

1. Publish a legit-looking skill to ClawHub (with clean branding and plausible features).
2. In SKILL.md, add a “Prerequisites” section that says you must install openclaw-core (or a similarly named “core utility”) first.
3. The install link doesn’t go to OpenClaw. It goes to attacker infrastructure: staging pages and script hosts (including glot.io snippets).
4. On macOS: users are nudged into pasting obfuscated shell commands. That pulls a second-stage payload which has been linked to Atomic Stealer (AMOS) — a commercial infostealer that targets credentials, API keys, browser passwords, and crypto wallets.
5. On Windows: victims get a trojanized ZIP (often password-protected to dodge scanners) containing a keylogger.
6. Some skills go extra feral: hiding reverse shells inside “normal” operational code, or quietly exfiltrating ~/.clawdbot/.env to a webhook collector.
7. The marketplace itself is permissive: ClawHub reportedly requires only a one-week-old GitHub account to publish. No vetting. No signing. No meaningful trust layer.

The key insight: markdown is an installer now

Daniel Lockyer (1Password) said the quiet part out loud: in an agent ecosystem, skills are just markdown — and markdown is powerful because it can instruct a human (or a bot) to run commands. That turns a documentation file into a de facto installer prompt.

This matters because the most dangerous code doesn’t always land through a formal package manager. It lands through instructions. The “click here, run this, trust me” lane.

“But we use MCP — aren’t we safe?”

MCP helps (a lot) when you’re constraining tool execution to well-defined servers. But it doesn’t magically protect you from a skill that says: “Hey operator, do this manual install step first.” That’s routing around your controls. A human copy/paste is still an execution primitive.

What this means for Feral Bots clients

This is exactly why we don’t treat “installing skills” like shopping. It’s not a marketplace. It’s an attack surface with branding.

• We vet every skill before it touches a client machine. Docs, code, outbound calls, install steps — the whole thing.
• We run a security-first tool posture: exec security controls, locked-down environments, and a safety scanner (new in OpenClaw 2026.2.6) designed to flag “this looks like malware onboarding.”
• We enforce least-privilege capabilities for external bots and integrations. Your agent shouldn’t have access to more than it needs — especially not by default.
• We don’t install skills blindly. We treat skills like third-party dependencies: audited, reviewed, pinned, and monitored.

Practical advice (what you can do today)

• Don’t install skills from unknown publishers just because the README has a nice tone.
• Read SKILL.md like a security reviewer. “Prerequisites” that involve downloads, ZIPs, scripts, or paste-into-terminal steps are a red flag.
• Never paste terminal commands from untrusted pages. If you must, type them manually and understand every token (yes, every token).
• Prefer signed / verified / pinned sources (and if the ecosystem doesn’t support that yet, treat it as “beta, handle with gloves”).
• Assume your bot’s environment contains secrets (because it does): API keys, browser sessions, OAuth tokens, crypto wallet access, notes.

Your bot is only as secure as what you let it install. In 2026, “I just wanted a YouTube summarizer” can turn into “why is my keychain gone.” Stay feral. Stay skeptical.