ClawHub’s AI Agent Skills Marketplace: A New Vector for Supply Chain Attacks

Think your AI assistant is just fetching data and scheduling meetings? Think again. A new platform is turning AI agents into potential weapons, and the entire digital supply chain is in the crosshairs.

The Skill Store with a Dark Side

ClawHub isn't just another repository. It's a burgeoning marketplace where developers can host and share specialized 'skills' for autonomous AI agents. These aren't simple plugins; they're capabilities that allow agents to interact with external systems, APIs, and data sources. The promise is immense: hyper-efficient workflows, automated decision-making, and seamless integration across platforms. The peril, however, is a security nightmare waiting to happen.

How the Attack Chain Unfolds

The threat model is classic supply chain attack, supercharged. A malicious actor uploads a seemingly useful skill—a financial data aggregator, a logistics optimizer, a compliance checker. Once downloaded and integrated into a corporate AI agent, the compromised skill becomes a backdoor. It can exfiltrate sensitive data, pivot to internal networks, manipulate transactions, or lie dormant until triggered. The AI agent, operating on trusted credentials, becomes the perfect mule, bypassing traditional perimeter defenses that never accounted for betrayal from within the digital workforce.

The Unpatchable Human Problem

Technical safeguards are racing to catch up, but the core vulnerability is human nature. In the relentless pursuit of alpha and operational edge, developers and firms will inevitably prioritize functionality over security audits. It's the same old story of convenience trumping caution, just dressed in a new, algorithmically sophisticated package—a lesson the finance sector should have learned after the last dozen high-profile breaches, but apparently needs a refresher course on.

The era of AI collaboration is here, and with it comes a stark warning: trust, but verify, especially when the new hire is made of code.

ClawHub conceals stealers in hundreds of skills

Earlier, Koi Research conducted AI-assisted research using an OpenClaw bot named Alex. The bot found 335 skills that were used to push the Atomic Stealer on macOS. 

“You install what looks like a legitimate skill – maybe solana-wallet-tracker or youtube-summarize-pro,” Koi researcher Oren Yomtov said. 

“The skill’s documentation looks professional. But there’s a ‘Prerequisites’ section that says you need to install something first.”

A Windows exploit is also active, calling users to download additional files from a GitHub repository. The supply chain attack also includes a keylogger, which can steal multiple credentials, including potentially uncovering crypto wallets. 

As Cryptopolitan reported earlier, OpenClaw agents are still in their early stages and are displaying unexpected behavior. Adoption is growing daily, posing new risks in cybersecurity and agent behaviors.

SlowMist continues tracking ClawHub skills for new threats

The recent supply chain attack may not be a one-off event. ClawHub is a relatively new space, attracting a large number of developers. SlowMist will be tracking the space as a source of supply chain attacks. The platform still lacks formal review mechanisms, allowing widely used skills to be infiltrated. 

There are still no clear reports of crypto theft through ClawHub. Previously, the public skills repo has contained malicious prompts linked to attempted crypto stealing. In the future, SlowMist will issue real-time alerts via its MistEye service to detect new malicious skills on ClawHub.

SlowMist has also identified an IP address that is reused in the malicious attacks. According to theat records, the IP 91.92.242.30 is historically linked to the Poseidon hacker group, known for extortion and data theft.

For end users, researchers advise against trusting the installation steps in new skills and to audit any commands that require copying and pasting. A common-sense preview of prompts is also a good check, looking for prompts asking for system passwords or other secure access. Users may wait for official channels and avoid installations from unknown sources.

Sharpen your strategy with mentorship + daily ideas - 30 days free access to our trading program