ClawHub after ClawHavoc: scanning 81,535 agent skills

tl;dr

We scanned 81,535 skills on ClawHub, OpenClaw’s public skill registry, with Supply Chain Agent Threat Rules (ATR): 785 detection rules that flag risky agent activity, such as running downloaded code, sending data or keys out, or overriding the agent’s instructions. We set aside 1,307 security tools and reviewed every rule match in the other 80,228 skills. None of the 1,242 skills with a match was malicious. 69 are risky by design, and the risks we found are ones the skills disclose: piping a download into a shell, switching off operating-system protections, and sending model API keys to third-party endpoints.

The scan follows ClawHavoc. In February 2026, The Hacker News reported that Koi Security had audited 2,857 skills on ClawHub and found 341 malicious ones. 335 of them, in a campaign named ClawHavoc, used fake prerequisites to deliver malware: a password-protected archive holding a keylogging trojan on Windows, and a glot.io script on macOS that led to the Atomic Stealer (AMOS) infostealer (The Hacker News, February 2, 2026). Five days later, OpenClaw announced VirusTotal scanning of ClawHub skills (OpenClaw, February 7, 2026). ClawHub now checks every new skill version with ClawScan, which OpenClaw described in June 2026 as combining static analysis, VirusTotal, and NVIDIA SkillSpector (OpenClaw, June 1, 2026). ClawHub blocks releases it judges malicious from download and re-scans active skills daily (OpenClaw, February 7, 2026).

Every skill we counted could be installed, because blocked releases are not in ClawHub’s export. ClawScan judges whether a skill’s behavior is disclosed and fits its purpose, and it marks skills it finds suspicious with a warning while leaving them installable, so the install decision stays with the user. This post covers what is still installable and what it means for IT and security teams.

• 1,307 of the skills we scanned are security tools: 111 offensive, such as pentest kits and CTF solvers, and 1,196 defensive, such as skill scanners and prompt-injection guards. They remain an attack vector, because a hostile or compromised security tool runs with the same agent permissions as any other skill. We set them aside because their deliberate attack content would inflate the counts for ordinary skills.
• Every skill we counted could be installed from ClawHub. ClawHub warns on skills it finds suspicious and leaves them installable, and all 25 risk examples we name in this post carried that warning when we checked them. Read the skill and its ClawHub security audit before you install it.
• 1,242 of 80,228 counted skills (1.55%) matched at least one Supply Chain ATR rule, and 615 (0.77%) had a critical match. 1,167 of those 1,242 skills were benign, so treat a match as a pointer to the lines worth reading before an agent loads the skill.
• We reviewed every match in those 1,242 skills: none was malicious, 69 were risky by design, 1,167 were benign, and 6 were unclear. Risky-by-design skills do what they say, such as routing your API key through a relay or exposing an agent to the internet, so the install decision is yours.
• 19 of the 786 verified-publisher skills we counted had a Supply Chain ATR match, and none was malicious. 371 of the 786, from NVIDIA and AWS, hand off to a GitHub repository at a fixed commit. ClawHub hands them out only after a clean or suspicious scan, but the files stay on GitHub, so read them at that commit before you install.
• 2,379 skills (2.97%) pipe a download straight into a shell. The script runs with your permissions before anyone reads it, and the publisher can change it without publishing a new skill version.
• 15 skills tell users to weaken an operating-system protection during install, such as removing macOS quarantine, adding Defender exclusions, or turning off antivirus. Each step switches off a check that would otherwise inspect what the skill asks you to download or run.
• 17 skills point ANTHROPIC_BASE_URL at a third party (10 at other model vendors, 7 at relays or gateways), so every prompt, the code in it, and your API key go to that endpoint. 3 more send an OpenAI key to a bare IP address over plain HTTP, where the key and every prompt cross the network unencrypted.
• 43.91% of skills have published more than one version, and clawhub install and clawhub update --all fetch the latest. A skill you reviewed can change after you install it, so pin the version you read and review each update before it reaches your agents.
• In MITRE ATLAS, the most matched techniques were AML.T0010 AI Supply Chain Compromise (699 skills) and AML.T0051 LLM Prompt Injection (180 skills). Skills reach agents through the supply chain and run as instructions, so plan reviews and controls around those two entry points.
• In OWASP, ASI01 Agent Goal Hijack (545 skills) and LLM01:2025 Prompt Injection (477 skills) lead. Skill text can steer what an agent does, which is the main thing to check before you install one.

The agent skill attack surface

An agent skill is a powerful attack surface because OpenClaw loads its SKILL.md file as instructions, and the agent then acts with the user’s files, shell, keys, and accounts. The path from a ClawHub listing to an agent’s actions takes six steps.

What the agent can reach in step 5 depends on the agent and its permission settings. A coding agent can typically read and write files and repositories, run shell commands, read environment variables that hold API keys, use the network, and act through connected accounts. Some agents also drive a browser with the user’s sessions and cookies.

MITRE ATLAS, MITRE’s knowledge base of attacks on AI systems, has entries for the main ways a skill can go wrong. Hidden instructions in a skill are LLM prompt injection (AML.T0051): prompts that “cause the LLM to act in unintended ways”. A skill can also tell the agent to send data out, or to run code it downloads. A skill that turns hostile after people adopt it is an AI supply chain rug pull (AML.T0109), where an attacker publishes legitimate components, “gain user adoption, then push an update with a malicious variant”. On ClawHub, that update would arrive as a new skill version.

Agents raise the stakes for three reasons. Skill instructions are natural language, so there is no fixed syntax that separates a helpful step from a harmful one. The agent often carries out several steps without a person reviewing each one. And one session can hold private data, untrusted content, and outbound network access at the same time.

How ClawHub works

ClawHub is “the public registry for OpenClaw skills and plugins” (ClawHub docs). It is open by default: anyone can upload, but publishing needs a GitHub account old enough to pass an upload gate. A skill is a versioned bundle of a SKILL.md file plus supporting files. Versions follow semver: a new skill starts at 1.0.0, later changes publish the next patch version, and tags default to latest (publishing docs).

ClawHub hosts the files of most skills itself. Its export API returns “the latest stored version files” for each hosted skill (HTTP API docs), and most of the skills we scanned were hosted on ClawHub. The exceptions are NVIDIA and AWS skills whose content lives on GitHub, described under What we scanned. Users install a skill with openclaw skills install @owner/slug or clawhub install @owner/slug. The install “Resolves latest version for the named owner and skill” and records the installed version in .clawhub/lock.json. clawhub update --all moves installed skills forward, and clawhub pin freezes one: “Pinned skills are skipped by update --all” (CLI docs).

ClawScan checks every new version before it is published. An OpenAI Codex agent reads the output of the static analysis, VirusTotal, and SkillSpector scans and returns a verdict of “Clean, Suspicious, or Malicious” (OpenClaw, June 1, 2026). Audits now also include findings from Tencent Zhuque Lab’s A.I.G scanner (security audit docs), and each skill’s page shows its latest scan state before install (ClawHub docs). Suspicious skills are marked with a warning and stay available, and malicious ones are “instantly blocked from download” (OpenClaw, February 7, 2026). Moderators can also hold, hide, quarantine, or revoke a listing (moderation docs).

What we scanned

We downloaded every skill we could get from ClawHub’s public export and scanned each skill’s SKILL.md file, the file an agent loads as instructions. Files were read as text, and nothing was installed or run.

This table shows how the ClawHub listing count becomes the number of skills we scanned, and then the number we counted after setting security tools aside.

Of the 825 verified-publisher skills we scanned, 39 are security tools. Of the 786 we counted, 371 from NVIDIA and AWS point to a GitHub repository at a fixed commit (NVIDIA/skills and aws/agent-toolkit-for-aws). We scanned that commit. ClawHub does not host these files: it hands out the repository and commit only after a clean or suspicious scan (HTTP API docs).

Releases ClawHub blocked as malicious, and skills it hid or quarantined, are not in the export, and ClawHub asks third parties not to mirror them (HTTP API docs). Our results therefore cover skills ClawHub did not block. We scanned skill files only, so a risk that sits only in a bundled script does not appear in our counts.

Security tools set aside

Many ClawHub skills are security tools. Offensive ones, such as pentest kits and CTF solvers, are risky by design. Defensive ones, such as skill scanners and prompt-injection guards, quote attack strings, payloads, and indicators so they can detect them. Both kinds are still an attack vector. A hostile or compromised security skill runs with the same agent permissions as any other skill, and security researchers who install one are exposed like anyone else. We found them by searching every skill for security terms, then reading each candidate and classifying it as offensive, defensive, or not a security tool.

We set the 1,307 security tools aside so their deliberate attack content does not drown out the risks in ordinary skills. 169 of them had a Supply Chain ATR match, 12% of all skills with a rule match, and most of those matches were the attack strings the tools quote on purpose.

This table breaks the security tools down by type, with two examples of each, how many had a rule match, and how many our review judged risky by design.

Every figure after this section counts the 80,228 remaining skills.

ClawHub’s scanning in practice

Two separate checks appear in this post. ClawScan is ClawHub’s own scanning of each release. A rule match is our finding: a Supply Chain ATR rule found a risky pattern in the skill’s SKILL.md.

Every skill we counted was available, because releases ClawScan blocks are not in the export, so all 1,242 skills with a rule match are skills ClawHub lets you install. ClawScan judges behavior against the skill’s stated purpose. ClawHub’s audit holds that “Powerful behavior is not automatically bad”, and it checks whether a capability is “disclosed, purpose-aligned, and supported by the release’s stated use case” (security audit docs). Skills like these get a suspicious warning and stay installable: every risk example we name later in this post carried that warning when we checked it. The warning tells you to look. Whether a pipe-to-shell install, a step that switches off an operating-system protection, or routing your API key through a relay is acceptable on your machines is your team’s decision.

To see what ClawHub found for a skill, open the security audit linked from its page. The skill record in ClawHub’s API includes a moderation verdict “only when the skill is flagged or the owner is viewing it” (HTTP API docs), so an empty verdict there does not mean a skill went unscanned, and this post does not compare skills by verdict.

We cannot measure what VirusTotal or ClawScan blocked. Blocked releases are not obtainable, and ClawHub asks third parties not to mirror “hidden, private, or moderation-blocked content” (HTTP API docs). In what remains, the ClawHavoc pattern of fake prerequisites, password-protected archives, and glot.io scripts is absent. Our pattern search found no fake download listings, and no counted skill contains a known ClawHavoc indicator. The indicators appear only in security scanners that list them, which we set aside. The risks left to manage are the disclosed install steps and endpoints described under Risks in installable skills.

Rule matches by severity

Each Supply Chain ATR rule detects one attack pattern, named in its title, and carries three labels: a severity (critical, high, medium, or low), an attack category such as prompt injection or skill compromise, and a maturity level. A rule’s maturity is stable, test, experimental, or draft. Stable and test rules are reliable enough to raise alerts, while experimental and draft rules are still being tuned, so every count in this post uses matches from stable and test rules only. 1,242 skills had a rule match. The chart counts each skill once, at the highest severity among its matches.

By attack category, Supply Chain ATR that look for compromised skill packages matched the most skills. A skill can match rules in more than one category, so the bars add up to more than 1,242.

Most frequent rules

These critical and high-severity Supply Chain ATR matched the most skills.

MITRE ATLAS mapping

Each Supply Chain ATR rule maps to one or more MITRE ATLAS techniques. Counting skills with a rule match under each technique, AI Supply Chain Compromise (AML.T0010) leads with 699 skills, followed by LLM Prompt Injection (AML.T0051) with 180. The matrix places all 22 matched techniques under their tactics, using names, tactics, and tactic order from ATLAS release 2026.09 (ATLAS data).

The largest counts sit under Initial Access and Execution, which is where a skill enters: it arrives through the supply chain, and the agent runs it as instructions. Four tactics had no matches.

OWASP mapping

Each Supply Chain ATR rule also maps to entries in two OWASP lists: the OWASP Top 10 for LLM Applications 2025 and the OWASP Top 10 for Agentic Applications 2026. The charts count skills with a rule match under each entry. A rule can map to several entries, so one skill can count under more than one. Prompt injection and goal hijack lead both lists, which matches what a skill is: text the agent follows as instructions.

Review of every match

We read every Supply Chain ATR match in the 1,242 skills with one, in the context of each skill file. These are the same skills as in the severity chart: 615 with a critical match, 596 with a high match at most, and 31 with a medium match at most. A skill counts once, under its most serious label.

This table gives the number of skills under each label, with what we found.

No reviewed skill was malicious. 69 skills are risky by design, described next under Risks in installable skills, and 1,167 were benign, explained in Why benign matches fired. The review covers skills ClawHub did not block that matched a rule, so it cannot show that no ClawHub skill is malicious: blocked releases are absent from the export, and a malicious skill that no rule matched would not appear here.

Other research reports a similar gap between a scanner flag and a finding. Holzbauer et al. report that marketplace scanners classify up to 46.8% of skills as malicious, and that after repository-aware analysis only 0.52% remain suspicious (arXiv 2603.16572), using a different dataset and method.

Risks in installable skills

Two kinds of risk remain in skills you can install from ClawHub. The first is a skill that is risky by design, where the stated purpose is the risk, such as a relay that carries your API key or a tunnel that puts an agent on the internet. Our review of every match found 69 of these. The second is a risky step inside an otherwise ordinary skill, such as an install command that pipes a download into a shell or a base URL that sends your API key to a third party. We found those by searching all 88,269 SKILL.md files in the counted skills (some skills hold more than one) for specific install steps and endpoints, then reading each hit. The two overlap in places, so their counts differ: the review starts from rule matches, and the search starts from the files.

Every named example in this section carried ClawHub’s suspicious warning and could still be installed when we checked it, so the decision on each one stays with you.

Risky by design

A risky-by-design skill does what it says, and installing it still needs an informed decision. This table sorts the 69 skills into six groups by what they do:

Pipe-to-shell installs

A pipe-to-shell install downloads a script and runs it in the same command, with no chance to read the script first. 2,379 skills (2.97% of counted skills) pipe curl or wget into sh, bash, zsh, or iex. For example, oomol/oo-aisa includes:

curl -fsSL hxxps://cli.oomol[.]com/install.sh | bash    # macOS / Linux

The script lives on the publisher’s server, outside the skill bundle, so it can change without a new skill version.

Bypassing OS protections

Fifteen skills give install steps that weaken an operating-system protection:

Examples:

• multilogincom/multilogin, line 89: xattr -d com.apple.quarantine /usr/local/bin/xcli
• frankxpj/optimize-laptop-power, lines 151 to 153, add Defender exclusions for D:\YourAIProjects, C:\Users\YourName\.openclaw, and C:\Users\YourName\.npm
• yu-libin/mediasync-claw, line 50: “Trust/add exception for frpc.exe in your security software if blocked.”
• aslancootl/openclaw-win-install-ai-assist, line 649: “Temporarily disable third-party antivirus”

Removing the quarantine attribute stops macOS from checking a downloaded program before its first run. A Defender exclusion keeps Windows from scanning a folder from then on. The .openclaw exclusion covers the folder where OpenClaw keeps its skills, so Defender would not scan files placed there later. An agent that follows these steps does so with the user’s permissions.

Third-party API endpoints

Pointing an API client at a different base URL sends your prompts, the code in them, and your API key to that endpoint. 35 skills set ANTHROPIC_BASE_URL:

Another 63 skills set OPENAI_BASE_URL, OPENAI_API_BASE, or a Gemini base URL, including 3 that point at a bare IP address.

Many of these are documented, intended setups, and pointing a client at another model vendor’s API is an ordinary choice. The risk is a routing choice the user may not notice. Once the variable is set, every request from a client that reads it goes to the new endpoint with the key attached. Decide whether you trust that endpoint with your code and credentials before an agent exports the variable for you.

Direct IP connections

A skill that connects to a raw IP address skips the checks many networks apply to domain names, such as DNS filtering and domain reputation, and an IP address is harder to attribute than a domain. 125 skills contain a URL with a public IPv4 host. We read each one:

Three skills are worth acting on: inuyashayang/worktree-codex, inuyashayang/codex-tmux, and inuyashayang/worktree-agents. worktree-codex, lines 41 to 42:

OPENAI_API_KEY="<key>" \
OPENAI_BASE_URL="hxxp://152[.]53[.]52[.]170:3003/v1" \

Over plain HTTP, the key and every prompt cross the network unencrypted, and the operator of that address receives both.

Public tunnels to a terminal

106 skills mention a tunnel such as cloudflared, ngrok, Tailscale Funnel, localhost.run, or frp, mostly to receive webhooks during development. Five use one to expose a terminal, a VNC desktop, a browser session, or local files to the internet: topcheer/remoting, topcheer/remotego, mosluce/line-oa-vnc-auth, michaellod/lock-me-in, and yu-libin/mediasync-claw.

topcheer/remoting says so on line 19: “Anyone with the URL can view and interact with the terminal from their browser.” yu-libin/mediasync-claw describes a tool that “automatically downloads and executes the third-party ‘frpc’ binary” to expose “local file systems and port 8000 to the public internet”. Anyone who has the URL has that access.

Install drift

A skill can change after you review it. 35,226 of the 80,228 skills we counted (43.91%) had published more than one version. clawhub install resolves the latest version, and clawhub update --all moves installed skills to the latest one. ClawScan checks each new version, so a release judged malicious is blocked. A release that adds a disclosed install step, a new endpoint, or a tunnel stays installable, at most behind a warning, and update --all installs it before you have read it.

ATLAS calls the hostile form of this a rug pull (AML.T0109). ClawHub records installed versions in .clawhub/lock.json, and clawhub pin keeps a skill at the version you reviewed.

Checks before installing a skill

Each check below follows from something the scan found. Together they let teams keep adopting skills while IT and Security keep the riskiest install steps off their machines.

1. Read the whole SKILL.md file and the skill’s ClawHub security audit. SKILL.md is the file the agent loads as instructions. A clean ClawScan result means the behavior is disclosed and fits the skill’s purpose, so disclosed behavior is yours to judge. A suspicious result comes with a warning, and the skill stays installable.
2. Check where the content comes from. A skill that hands off to a GitHub repository at a commit keeps its files on GitHub, so read the files at that commit before you install it.
3. Read what a pipe-to-shell install fetches. Download the script, read it, and then decide whether to run it. The script can change without a new skill version.
4. Refuse steps that weaken protections. Search for xattr -d com.apple.quarantine, Add-MpPreference -ExclusionPath, antivirus exceptions, and instructions to disable antivirus or click through SmartScreen.
5. Check every base URL. Search for ANTHROPIC_BASE_URL, OPENAI_BASE_URL, and OPENAI_API_BASE, confirm you trust the endpoint with your prompts and key, and refuse a key sent over plain HTTP.
6. Check what a tunnel exposes. A tunnel for webhooks is ordinary. A public URL to a terminal, desktop, browser, or file system gives its holder that access.
7. Pin what you reviewed, and review again on update. Use clawhub pin for skills you have read, check .clawhub/lock.json for installed versions, and read the new version before clawhub update --all moves a skill forward (see Install drift).

Check a skill repository

Check a skill before your teams install it using Supply Chain. Open Supply Chain and paste a GitHub repository URL, upload a ZIP of the skill folder, or paste its SKILL.md.

For scripts and CI pipelines, use the Supply Chain API, documented on our docs portal. Most ClawHub skills have no repository, so zip the skill folder and submit it:

export SIGNALS_API=https://controlplane.signalscorps.com
zip -r skill.zip PATH/TO/SKILL
curl -s -X POST "$SIGNALS_API/api/v1/communities/$COMMUNITY_ID/supply-chain/on-demand/scans/zip" \
  -H "Authorization: Bearer $SIGNALS_TOKEN" \
  -H "Content-Type: application/zip" \
  --data-binary @skill.zip

For a skill that points to a GitHub repository, such as the NVIDIA and AWS skills, submit the URL:

curl -s -X POST "$SIGNALS_API/api/v1/communities/$COMMUNITY_ID/supply-chain/on-demand/scans/repository" \
  -H "Authorization: Bearer $SIGNALS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input_type": "repository_url", "label": "skill review", "url": "https://github.com/OWNER/REPO"}'

Both return a scan_id. Fetch the result once it is completed:

curl -s "$SIGNALS_API/api/v1/communities/$COMMUNITY_ID/supply-chain/scans/$SCAN_ID" \
  -H "Authorization: Bearer $SIGNALS_TOKEN"

For each match, read the lines around it and decide whether the skill does what it says.

Why benign matches fired

1,167 of the 1,242 skills with a match were benign and do ordinary, useful work. Their wording or commands look like an attack pattern, so Supply Chain ATR fired, and reading the surrounding lines showed a legitimate purpose. Scanner and auditor skills, including those that ship malicious test fixtures, are among the security tools we set aside. The 30 skills with defensive lists here are ordinary skills, such as wallet skills that list injection phrases to refuse and QA skills with XSS test strings. The chart counts each skill once, under the reason for its most serious match.

These are skills you would not want to block. They do useful work, and most teams will install them. They are still worth knowing about, because benign does not mean harmless to hand to an agent: these skills show the reach an agent gets. A setup step that checks cloud instance metadata reaches an endpoint that, on many cloud hosts, also serves the machine’s credentials. A key-safety note tells the agent which host may receive your key. A list of injection phrases to refuse puts attack strings into the agent’s context so it can recognize them. Here each instruction does what it says. The same instruction from a hostile author, or after a malicious update, would read the same way, which is why the rules flag the pattern.

The practical answer is visibility. Knowing which installed skills reach cloud metadata, route keys, or carry attack strings lets a team keep using them and spot the moment one changes. Supply Chain reports these matches next to the critical ones, so a team can keep this lower-risk attack surface in view without blocking the skills it relies on.

Summary

Since ClawHavoc, ClawHub blocks releases its scanning judges malicious. We set aside 1,307 security tools, reviewed every Supply Chain ATR match in the 1,242 counted skills with one, and found no malicious skill. The risks we found are ones the skills disclose: 69 skills that are risky by design, and install steps and endpoints such as pipe-to-shell installs, steps that weaken operating-system protections, and API keys routed to third parties. Read each skill before an agent loads it, refuse the steps you would not run yourself, and pin the version you reviewed. Security tools run with the same agent permissions as any other skill, so they need the same review.

Skills from other places do not go through ClawHub’s scanning. That includes skills from GitHub repositories, gists, links shared in chat, and other marketplaces. Skills and agents that employees build inside a company skip it too. Each of these needs a second, independent check before an agent loads it: the same rules applied to every source, and someone who reads each match in its context.

None of the 1,242 skills with a rule match was malicious, and the scan still shows why the agents your teams use need oversight. Skills ask agents to run install commands, send API keys to outside endpoints, and open tunnels to the internet, all in the open. Whether each of those is acceptable depends on your own security policy, so teams need to see which skills their agents load and check that what each one does fits that policy.

Signals Corps Control Plane runs these checks across sources through its Supply Chain module, so teams can apply one review to skills wherever they come from.