More Malicious OpenClaw Skills Threaten AI Supply Chain

Dark Reading

Original Source

Dark Reading

// Analysis

Security researchers have uncovered multiple malicious skills circulating on ClawHub, the official marketplace for the OpenClaw agentic AI ecosystem. These skills demonstrate novel methods for stealing credentials, bypassing security systems, and manipulating agent behavior for financial gain, highlighting a significant and evolving AI supply chain attack surface. Unit 42 researchers at Palo Alto Networks identified five such skills, categorizing them into infostealers, detection evasion, and agentic threats.

// Why It Matters

Signal Intelligence Assessment

The successful bypass of integrated security measures like ClawScan and VirusTotal by these new malicious skills signals that current automated defenses are insufficient for agentic AI marketplaces, requiring OpenClaw developers and practitioners to anticipate and develop against more adaptive evasion techniques.
The identification of "agentic affiliate injection" and "agentic front-running" as novel threat categories shifts the focus for builders from traditional data exfiltration to more insidious manipulation of agent behavior, recommendations, and workflows for financial gain, necessitating new security paradigms for agent integrity.
The persistent and evolving nature of malicious skills on ClawHub, evidenced by the high prevalence rates from previous reports (e.g., 17% from Bitdefender, 341 from Koi Security) and the continued discovery of sophisticated new attacks, underscores a critical and systemic AI supply chain vulnerability within the OpenClaw ecosystem that practitioners must factor into deployment risk assessments.
The inherent difficulty in detecting malicious intent within plain-language instructions, which forms the basis of agent skills, establishes a fundamental limitation for current automated security analysis, informing OpenClaw developers that a "cat-and-mouse game" dynamic will likely persist and require multi-layered, evolving defensive strategies beyond static code checks.

Analyzed 17:00 PT · Trace No. 005 · June 2026

Back to Trace No. 005 · June 2026