ClawHavoc: 341 Malicious ClawHub Skills and a Count That Kept Moving

On 1 February 2026 the security firm Koi Security published an audit of ClawHub, the skill marketplace attached to the open-source AI agent OpenClaw: of the 2,857 skills listed there, it reported 341 as malicious, with 335 of them traced to a single coordinated operation it named ClawHavoc. That is just under 12 per cent of the marketplace. The main payload was Atomic Stealer, known as AMOS, a commodity macOS infostealer that The Hacker News reports rents for roughly $500–1,000 a month, and it arrived through the step users are most conditioned to perform without thinking — a "Prerequisites" section telling them to install one more thing first. Windows users were pointed at a password-protected ZIP on GitHub; macOS users at a shell command hosted on glot.io and told to paste it into Terminal. The archive's own entry for the campaign, with its severity and confidence grades, sits in the Orca AI Incident Archive next to the other supply-chain incidents recorded that week.

What Koi actually looked at

ClawHub is a community marketplace that sits alongside OpenClaw, a self-hosted AI assistant formerly known as Clawdbot and Moltbot. Skills are the extension mechanism: packaged instructions plus scripts that teach the agent to do a specific thing — read a Solana wallet, summarise a YouTube video, track prices on Polymarket. Installing one means granting it the same reach the agent has.

Koi ran its audit with an OpenClaw bot of its own, named Alex, according to The Hacker News' report of 2 February. The researcher quoted in that report, Oren Yomtov, described the lure in plain terms: "You install what looks like a legitimate skill — maybe solana-wallet-tracker or youtube-summarize-pro. The skill's documentation looks professional. But there's a 'Prerequisites' section that says you need to install something first."

The reason there was a market to poison at all is that ClawHub was open by default. The Hacker News reported that anyone could upload, and the only restriction at the time was that the publisher's GitHub account had to be at least a week old. Koi's own report described the platform as having "virtually no security review mechanisms," a line Antiy CERT quotes in its own analysis.

How the payload arrived

The delivery differed by operating system but the shape was the same: the skill itself is mostly harmless, and the harm is in the installation instructions.

• On Windows, the documentation linked to a GitHub release containing a password-protected ZIP. Inside was a trojan with keylogging capability aimed at API keys, credentials and whatever else the bot on that machine could already reach — which, on an agent host, is a great deal. Antiy CERT's report says the archives typically carried one of three passwords (1202, openclaw or 1234) and notes the point of the encryption: it gets the file past GitHub's own scanning and past real-time scanning on the victim's machine.

• On macOS, the documentation told users to copy a script hosted at glot[.]io and paste it into Terminal. The script ran obfuscated shell commands, reached out to 91.92.242[.]30 for a second script, and that script fetched a universal Mach-O binary — one build for Intel and Apple Silicon alike.

Koi assessed that binary as exhibiting traits consistent with AMOS. OpenSourceMalware, the research outfit run by Paul McCarty, reported the same campaign on the same day and assessed its own sample a little differently: probably a new NovaStealer strain. The two reports agree on the infrastructure, the lure and the targeted data — exchange API keys, wallet files, browser-extension data including MetaMask, seed phrases, the macOS Keychain, saved browser passwords, SSH keys, cloud and Git credentials, .env files — but not, precisely, on the family label. Both attributions are the researchers' own.

Not every malicious skill was a ClawHavoc prerequisite lure. Koi reported skills — including better-polymarket and polymarket-all-in-one — that hid reverse-shell backdoors inside otherwise working code, so the compromise came at normal use rather than at install. Another, rankaj, sent bot credentials stored in ~/.clawdbot/.env to a webhook[.]site endpoint. Names were built to be misread at speed: clawhubb, cllawhub, clawwhub, clawhubcli, alongside crypto, YouTube, auto-updater and Google Workspace lookalikes.

Antiy CERT adds a detail worth flagging as its assessment rather than a finding: it says the supporting documentation on these skills runs 500–700 lines and was "likely AI-generated themselves." That is an inference from the documents' length and consistency, not something the report proves.

The count is not one number

The figure that follows ClawHavoc around is not stable, and the reason is that the audits were answering different questions on different days.

Koi's 341 is a count of live listings at the moment of its sweep: 341 malicious entries out of 2,857 skills it examined, 335 of them one campaign. OpenSourceMalware's numbers describe a publication wave rather than a marketplace snapshot — 28 malicious skills published between 27 and 29 January, then 386 more between 31 January and 2 February, attributed across seven publisher accounts, with 354 of the second batch from a single account, hightower6eu. Antiy CERT's 1,184 is a count of history: malicious packages it identified in ClawHub's repository as of 5 February, attributed to 12 author IDs, with hightower6eu at 677 and sakaen736jih at 390. Antiy also recorded that 60 packages from one uploader, moonshine-100rze, were still accessible at publication and had accumulated 14,285 downloads, and that the platform held 3,498 skills once the large-scale removals were done.

Then there is 824. The archive's record notes the figure as a later revision, but it does not trace to a dated primary publication the way the other numbers trace to Koi, OpenSourceMalware and Antiy. Where it turns up is later third-party commentary — for instance a March 2026 Hacker News post by the author of a skill scanner, which describes "824 malicious skills (20% of ClawHub)" without naming the audit behind it. The arithmetic there does not close against the other published figures either: 824 is a little under 29 per cent of 2,857, so the "20 per cent" implies a different denominator again, unstated. Treat it as a number in circulation rather than a number with a published methodology. The same caution applies to the "1,200+" variants that appear in later write-ups.

None of these are wrong so much as non-comparable: listings at one moment, publications across a window, and a repository's whole history are three different denominators, and a typosquat variant can be one entry or several depending on how the counter grouped them.

What OpenClaw changed

Two things, both inside the week that followed Koi's disclosure.

The first was user reporting. The Hacker News reported that OpenClaw's creator, Peter Steinberger, shipped a feature letting signed-in users flag a skill, with documentation stating that each user may hold up to 20 active reports and that "skills with more than 3 unique reports are auto-hidden by default." That is a triage mechanism, not a scanner, and it depends on someone noticing first.

The second was the VirusTotal partnership, announced by OpenClaw on 7 February 2026. As described in OpenClaw's own post: every skill bundle is packaged deterministically into a ZIP with consistent compression and timestamps plus a _meta.json carrying publisher and version data; a SHA-256 hash is generated; the hash is checked against VirusTotal's threat intelligence, and if no verdict exists the bundle is uploaded through VirusTotal's v3 API. VirusTotal's Code Insight — an LLM-driven review that OpenClaw's post says is "powered by Gemini" — reads the whole package starting from SKILL.md. Verdicts drive action: benign skills are auto-approved, suspicious ones carry a warning but stay visible, malicious ones are blocked from download. All active skills are re-scanned daily, and suspected false positives go to [email protected].

OpenClaw was explicit about the limits in the same post, calling the integration "not a silver bullet" and warning that "a clean scan doesn't mean a skill is safe," because natural-language manipulation and prompt injection may not be caught by signatures or a threat database. Antiy CERT's assessment points the same way from the outside: it calls the reporting feature necessary but far from sufficient, and argues that store-scale defence needs static analysis, code and semantic analysis, sandbox execution and a response team behind them.

What is established, and what is not

A note on sourcing first, because it matters for everything above. Koi's original post no longer resolves at its published address. The koi.ai URL cited by the archive now redirects to a Palo Alto Networks Cortex product page, following Palo Alto Networks' acquisition of Koi, which the company announced as completed on 14 April 2026. So Koi's figures and quotes here are taken from outlets that read the report while it was live — The Hacker News on 2 February, eSecurity Planet on 3 February, Gadget Review on 11 February — and from Antiy CERT, which cites the Koi report directly in its own February analysis. Koi's post itself could not be read for this article.

Established: that Koi audited 2,857 skills and reported 341 malicious, 335 of them one campaign; the prerequisite-lure mechanism on both operating systems; the command-and-control address 91.92.242[.]30; the reverse-shell and .env-exfiltration outliers; the reporting feature; and the VirusTotal integration with the pipeline described above. Real harm is not in doubt — Antiy recorded 14,285 downloads across 60 still-accessible packages from a single uploader, and OpenSourceMalware put one publisher's total at almost 7,000 downloads — and the data the payloads went after is exactly the data an agent host concentrates: wallet keys, exchange API keys, SSH keys, cloud tokens, browser passwords.

Divergent: the count, for the reasons in the section above, and the malware family label.

Not established, at least in anything published that this article could read: how many people actually installed a malicious skill, how many credentials were stolen, or whether any of the stolen funds or keys have been traced. Antiy says malicious skills "had been downloaded thousands of times, infecting Windows and macOS users" — that is an assessment of exposure, not a victim count, and no publisher has produced one. Whether all 341 listings were live at the moment Koi published is likewise unstated.

The durable fact is the shape of the failure rather than the arithmetic. A marketplace that anyone could publish to, in an ecosystem where installing a package means handing it the agent's credentials, produced a campaign whose entire exploit was a README telling the user to run something — and the first automated defence arrived six days later, aimed at signatures and model review rather than at the trust model that made the lure work.