What is OpenClaw and why is the ClawHub marketplace a security concern?

OpenClaw is an AI agent framework that runs third-party skills sourced from ClawHub, a dedicated marketplace. Skills have deep access to local systems, file storage, browser sessions, and credentials. The security concern is that ClawHub's automated screening (VirusTotal and ClawScan integration) can be bypassed through techniques like embedding malicious payloads in oversized files that exceed scanner limits, making it a viable supply chain attack surface for distributing malware to anyone who installs a compromised skill.

How did the malicious OpenClaw skills evade detection?

Unit 42 documented several bypass techniques. One skill called omnicogg embedded an AMOS malware dropper inside a README.md file and padded it with 22MB of junk characters to exceed file size limits that most scanning pipelines enforce. Others hid payloads in Base64-encoded strings executed via curl-pipe-bash droppers. The skills passed ClawHub's VirusTotal and ClawScan checks because the malicious content was either too large to scan or was encoded in ways the static scanners didn't recognise.

What should organizations running OpenClaw do right now?

Audit which ClawHub skills are installed and remove any not actively needed. Restrict OpenClaw from running skills installed by non-administrator users. Monitor outbound connections from OpenClaw processes for unexpected destinations — specifically the C2 infrastructure at 91.92.242.30 documented in the Unit 42 research. Treat skill installation events as equivalent to npm package installations: require review before adding new skills in any environment with access to sensitive credentials or data.

OpenClaw Marketplace: Malicious AI Skills Bypassing Security Scans

The package manager supply chain attack is a well-understood threat at this point. Malicious packages on npm, PyPI, and RubyGems have been a recurring theme for several years: squatting on popular package names, typosquatting, poisoning legitimate packages, and compromising maintainer accounts. Security teams have built tooling, policies, and detection rules around it.

Now the same dynamic is playing out in AI agent skill marketplaces, and the detection tooling hasn’t caught up yet.

Unit 42 researchers published findings on five malicious skills that appeared on ClawHub, OpenClaw’s third-party skill marketplace, between February and May 2026. The skills slipped past ClawHub’s automated screening, which integrates VirusTotal and ClawScan, and stayed live long enough to reach real users before being identified and removed. Three threat categories were represented: infostealers, detection evasion, and agentic threats designed to abuse the agent’s own capabilities for financial fraud.

What ClawHub Is and Why It Matters

OpenClaw is an AI agent framework that executes third-party skills from ClawHub via markdown-driven packages. The design gives skills significant access to local systems: file storage, browser sessions, clipboard content, and anything the agent’s credential store can reach. That’s a different risk profile from a web browser extension or a VS Code plugin. An agent running a malicious skill has deeper system access than either.

ClawHub positions itself as a curated marketplace with automated scanning. The Unit 42 findings show that automated scanning is insufficient on its own — and that threat actors know how to work around it.

How the Skills Bypassed Scanning

The clearest example is omnicogg, a skill that embedded a Base64-encoded curl-pipe-bash AMOS dropper inside a README.md file. The file was then padded with 22MB of junk characters. Most static scanning pipelines enforce file size limits to prevent resource exhaustion — omnicogg was specifically sized to exceed those limits, causing scanners to skip it.

The dropper, once triggered, connected to 91.92.242.30, a C2 IP address also documented in earlier AMOS campaigns, and retrieved the full Atomic macOS Stealer payload. Trend Micro independently confirmed a separate ClawHub skill distributing AMOS via the same infrastructure.

Other skills in the Unit 42 findings used detection evasion techniques: fragmented payloads assembled at runtime, legitimate-looking metadata and README content to pass casual human review, and staged execution that deferred malicious activity until after initial installation checks.

The detection evasion category is arguably the most concerning. Skills designed not to steal credentials immediately but to observe and report on the agent’s environment over time — learning what access exists, what credentials are cached, what systems the agent touches — are harder to catch with signature-based detection.

The Agentic Threat Category

Beyond infostealers, Unit 42 documented a third threat category: skills that abused OpenClaw’s own capabilities for financial fraud. These are not skills that exfiltrate data to an attacker’s server. They are skills that use the AI agent’s legitimate access — to payment APIs, browsing sessions, and authenticated accounts — to conduct fraud on behalf of an attacker who controls the skill.

This is a qualitatively different threat from a traditional infostealer. The malicious activity happens inside the agent’s existing session, using credentials the agent already has, in ways that look like legitimate agent activity from the outside. Rate limits, IP reputation checks, and transaction monitoring all see normal agent behaviour. The fraud is inside the trust boundary.

Koi Security’s earlier ClawHavoc research documented 341 malicious skills with similar patterns. Acronis identified 575 malicious skills from thirteen developer accounts. These are not isolated incidents. ClawHub has a systematic supply chain problem, and the attack surface is growing as OpenClaw adoption expands.

The npm Parallel

The npm ecosystem has been dealing with this since at least 2018. The differences: npm has 2.5 million packages and receives billions of weekly downloads. ClawHub is orders of magnitude smaller. But skill capabilities in an agentic AI context are more dangerous than most npm packages, because a skill can direct the agent to take real-world actions — sending emails, executing transactions, modifying files, exfiltrating data — using the user’s own authenticated identity.

The skill marketplace model is being replicated across the agentic AI ecosystem. OpenClaw is one platform; there are several others in various stages of development or deployment. The underlying security property is the same: third-party code running with agent-level access, screened by automated tools that can be bypassed, installed by users who trust the marketplace branding.

This is the supply chain problem for the agentic AI era. It needed to happen to get attention, and it has happened.

What Defenders Should Do

For security teams with OpenClaw deployments:

Treat ClawHub skill installation as equivalent to npm package installation in a sensitive environment. That means: require review and approval before adding skills, restrict who can install skills, maintain an inventory of installed skills with their version history.

Monitor outbound network connections from OpenClaw processes. The 91.92.242.30 C2 is documented and should be blocked at the perimeter, but more importantly, any unexpected outbound from agent processes to non-approved endpoints warrants investigation.

Review installed skills now. Unit 42 reported the five malicious skills and they were removed, but earlier ClawHavoc and Acronis findings suggest the marketplace had hundreds of malicious skills at various points. If skills were installed during the February-May 2026 window without review, assume they should be audited.

For teams evaluating agentic AI platforms: the existence of a marketplace with automated scanning is not a security guarantee. Treat it as a starting point, not an endpoint. The same due diligence that applies to open-source dependencies applies to agent skills.