Threat Research Center Threat Research Malware Malware OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat 9 min read Related Products Advanced DNS Security Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Cortex Cortex XDR Cortex XSIAM Unit 42 AI Security Assessment Unit 42 Frontier AI Defense Unit 42 Incident Response By: Shresta Bellary Seetharam Nabeel Mohamed Billy Melicher Oleksii Starov Published: June 23, 2026 Categories: Malware Threat Research Tags: Agentic AI ClawHavoc ClawHub Defense evasion Infostealer OpenClaw Payload VirusTotal Share Executive Summary OpenClaw is an AI agent that executes third-party skills from ClawHub, its dedicated marketplace. Skills are markdown-driven packages with broad local system access, making ClawHub a critical link in the agentic software supply chain. Following its release, the ecosystem saw several malicious campaigns. Those early findings, published in February 2026, prompted ClawHub to integrate VirusTotal and ClawScan, enabling proactive screening of published skills and code-level analysis to block skills flagged as malicious from download. However, our analysis from February-May 2026 revealed persistent and evasive malicious skills on ClawHub. We identified five unblocked skills. We reported all five to ClawHub for takedown. OpenClaw banned the accounts mentioned and deleted all of the skills. The five skills represent three distinct threat categories leveraging the AI supply chain ecosystem: Infostealers: Two skills delivered macOS infostealers. Both connect to command-and-control (C2) infrastructure, indicating persistent threat actor activity. Evasion: One skill has an inflated file size to exceed scanner thresholds, bypassing both ClawScan and VirusTotal detection. Agentic threats: Two skills represent agentic threats: runtime agentic affiliate injection and agentic front-running. Both are novel techniques that the skill authors used for financial gain. OpenClaw is now also collaborating with NVIDIA to provide documentation of what each skill does, and to run NVIDIA’s analysis tool on all skills. Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: Koi Agentic Endpoint Security (AES) Advanced URL Filtering Advanced DNS Security Prisma Browser Advanced WildFire Cortex XDR and XSIAM The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-specific risks. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team . Related Unit 42 Topics Agentic AI , OpenClaw , ClawHub , Supply Chain, Infostealer AI Agent Skills as a Supply Chain Attack Surface Software supply chain attacks typically rely on compromising distribution vectors or spoofing dependencies. However, AI agent ecosystems have altered this paradigm, and their threat model differs from previously established ecosystems like npm or PyPI . While conventional malware often faces limitations from language runtimes or containers, malicious skills use semantic instruction hijacking to bypass technical constraints. By misusing the AI’s natural language interpretation, malicious skills can exploit the agent's operational context, including file systems, shells and credential managers, without requiring a conventional exploit. The lack of isolation between skill logic and agent authority means that installation results in complete control over the agent's identity. This allows a malicious skill to perform unauthorized actions through the agent’s own authenticated sessions. Early Campaign Activity on ClawHub In early February 2026, Bitdefender Labs reported that approximately 17% of OpenClaw skills they analyzed in the first few weeks of the platform's release carried malicious payloads. Koi Security's ClawHavoc disclosure documented 341 malicious skills, and Trend Micro separately confirmed skills distributing Atomic macOS stealer (AMOS) malware across the marketplace. This early wave featured several distinct techniques: Base64-encoded curl-pipe-bash dropper : These skills embedded a fake prerequisite block that instructed the agent to decode and execute a Base64-encoded remote payload, typically fetched from 91.92.242[.]30 , the IP address for an AMOS C2 server. Platform-specific delivery: For macOS targets, paste-site redirects ( glot[.]io, rentry[.]co ) served as an intermediary step, allowing attackers to update payloads without modifying the published skill. Attackers directed Windows targets to password-protected executables hosted on third-party hosting services. ​​ Persistence via auto-updaters: Auto-updater skills combined the initial dropper with scheduled cron job registration, ensuring the C2 channel persisted even after skill removal. Alternative exfiltration channel : A distinct cluster ( polymarketbtc, polymarketbtcassistant and related skills published by krajekisbtc ) exfiltrated cryptocurrency private keys via the Telegram Bot API, a C2 channel independent of the shared dropper infrastructure. Registry saturation : A single publisher account injected malicious payloads into the majority of their published skill catalog with identical payloads to maximize installation surface before detection. Those findings prompted ClawHub to partner with VirusTotal , enabling proactive screening of published skills. These skills from these early campaigns have since been removed from the marketplace or marked as malicious. In the following sections, we document the state of the marketplace between February and May 2026, during which VirusTotal and ClawScan served as the primary screening mechanisms. (On June 1, ClawHub also announced a partnership with NVIDIA to help screen published skills.) The AMOS dropper infrastructure from earlier campaigns remains active more than three months after first public disclosure, with the C2 server at 91.92.242[.]30 continuing to receive new skill deliveries. Additionally, we observe novel attacks that adapt to and exploit skill marketplaces, leveraging the agentic execution model to implement financial schemes that evade some kinds of malware detection. Malicious Skills Distributing ClawHavoc Payload Publisher/Skill: [redacted]/tradingview-ai-indicator-assistant SHA256 hash: b6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007 On May 17, 2026, the account published two skills targeting TradingView users as shown in Figure 1. Figure 1. ClawHub marketplace listings for two TradingView assistant skills. Both of these skills presented as AI assistants for macOS, posing as productivity tools for traders. Both embedded the same malicious prerequisite block, which prevented the skills from functioning until the user performed a required action. In this case, the prerequisite block directed agents to a site with malicious instructions to copy and paste text into a terminal window. We refer to this site as a paste-site redirect lure. The paste-site redirect lure at hxxps[:]//rentry[.]co/openclaw-code served instructions with a Base64-encoded string for the prerequisite block, which the agent must run before the skill can continue. Figure 2 below shows an example of this page. Figure 2. Paste-site redirect lure. When the agent performed the actions in the paste-site redirect lure, the associated command fetched a payload from hxxp[:]//2.26.75[.]16/Xuvewuyur . That payload was a macOS infostealer named cluw with a SHA256 hash of 818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7 . The delivery mechanism is structurally identical to the ClawHavoc campaigns documented by Koi Security and Trend Micro . The prerequisite block, the paste-site redirect lure and the Base64 pipe to bash all match the early-wave pattern. The C2 server we discovered at 2.26.75[.]16 differs from prior disclosure. The cluw payload differs from AMOS. This campaign used the established delivery template with fresh backend infrastructure. Until mid-May, ClawHub's automated auditing returned a verdict of Pass for ai-tradingview-assistant-for-macos and no verdict for tradingview-ai-indicator-assistan t. Neither skill triggered detection, despite containing a verbatim paste-site prerequisite lure. This structural pattern characterized over 300 skills in the original ClawHavoc disclosure. File Padding for Defense Evasion Publisher/Skill: [redacted]/omnicogg SHA256 hash: b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2 The omnicogg skill was an early-wave threat, similar to those that defined the initial surge of malicious activity on ClawHub. It is a Base64-encoded curl-pipe-bash dropper that delivered the AMOS malware via 91.92.242[.]30 , the same C2 infrastructure documented in earlier campaigns. This skill is distinguished by its delivery vessel, a README.md file. The malicious payload appears at the start, followed by 22 MB of padding characters. This padding inflates the file size beyond the limits that many content-analysis pipelines enforce before declining to process a file. Figure 3 below shows an example of the padding characters in this file. Figure 3. The omnicogg skill’s README.md file. JFrog Security Research disclosed this skill in March 2026. This evasion technique can be effective because many scanning pipelines skip abnormally large files rather than process them. This skill's ClawScan audit was in review in mid-May, while VirusTotal returned a clean verdict, and the skill remained available for download, as shown in Figure 4. Scanners that do not analyze content beyond standard thresholds will miss payloads structured to exploit that weakness. Figure 4. ClawHub audit page for [redacted]/omnicogg shows an overall pass despite containing malicious code. . Runtime Agentic Affiliate Injection Publisher/Skill: [redacted]/money-radar SHA256 hash: ebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d This ClawHub campaign fo