In the wild
Five malicious OpenClaw skills on ClawHub: macOS infostealers, scanner evasion, affiliate injection and crypto front-running
AIR-2026-0139 AIR record · 2026-06-unit42-clawhub-malicious-skills
From the supporting source
The lack of isolation between skill logic and agent authority means that installation results in complete control over the agent's identity.unit42.paloaltonetworks.com
The record
Disclosed
2026-06-23
Occurred
2026-02
Vendor
OpenClaw
Product
OpenClaw / ClawHub skill marketplace
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Unsafe actuation, Credential theft
System type
Generative model
Who acted
Agent acted — the agents executed the malicious skills' payloads
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Malicious marketplace package
Impact type
Credential theft, Malware installation, Financial manipulation, Financial fraud, Unauthorized action
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Users who installed the five skills before takedown (Feb-May 2026)
Capability abused
Defense & remediation
Recorded defense
ClawHub screening via VirusTotal and ClawScan
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Skills removed from ClawHub
Taxonomy & references
Curator notes
Named skills: cluw and an AMOS variant (macOS infostealers), omnicogg (22 MB README.md padding to evade scanners), money-radar (runtime affiliate injection), letssendit (agentic crypto front-running / pump-and-dump). Authors Bellary Seetharam, Mohamed, Melicher, Starov. No published victim count, so impact_realized left false. Also reported as: 'Unit 42 finds five malicious ClawHub skills that evaded VirusTotal and ClawScan, including 22 MB padding evasion and runtime affiliate injection'.
Supporting sources
Cite as
Enkrypt AI. "Five malicious OpenClaw skills on ClawHub: macOS infostealers, scanner evasion, affiliate injection and crypto front-running". AIR, AIR-2026-0139. https://agentincident.vercel.app/i/AIR-2026-0139/ (accessed 2026-10-19).