ClawHub Supply Chain Exploitation
What Happened
On February 5, 2026, security researchers at Snyk Labs published "ToxicSkills"—the first comprehensive security audit of the AI Agent Skills ecosystem. Scanning 3,984 skills across ClawHub (the public marketplace for the OpenClaw agent framework) and skills.sh, they found that 1,467 skills (36.82%) contained at least one security flaw, and that 534 skills (13.4%) carried at least one critical-severity issue, spanning malware distribution, prompt injection and exposed secrets. Human-in-the-loop review confirmed 76 skills carrying active malicious payloads designed for credential theft, backdoor installation and data exfiltration; 8 of those remained publicly downloadable on ClawHub at the time of publication.
Agent skills are markdown-driven packages that execute with the full privilege set of the host agent—filesystem access, terminal execution, network egress and credential visibility—without sandboxing, which is what converts a registry listing into a direct code-execution path.
Distinct concurrent campaign (do not merge): In the same month, Koi Security audited 2,857 ClawHub skills and identified 341 malicious entries, 335 of them traced to a single coordinated operation designated ClawHavoc, which used fake installation prerequisites to deliver the Atomic macOS Stealer (AMOS). Separately, Palo Alto Unit 42 analysed the ecosystem from February to May 2026 and found five malicious skills that evaded ClawHub's VirusTotal and ClawScan screening. These are three separate findings with different scopes and figures and should not be cited interchangeably.
Source: Snyk Labs ToxicSkills, 5 February 2026 (primary); Koi Security ClawHavoc audit, February 2026; Palo Alto Unit 42, June 2026. Epistemic label: Grounded.
How MEG 1 would have acted
The skills ecosystem failed safety audits, violating informational security and user trust by allowing unverified, malicious payloads to masquerade as trusted tools.
MEG 2 Analysis - Legal Framework
Agent level: N3 (individualized/advanced) - developer-focused coding agent executing third-party skills with broad system access and local command execution capabilities.
Cause (6.1):
(a) system defect - design flaw in the skills registry (ClawHub): absence of effective package verification and provenance guarantees at the time of the audit. Note that ClawHub did introduce VirusTotal and ClawScan screening in February 2026 following early campaigns; Unit 42's subsequent findings establish that the screening was demonstrably bypassable (via payload padding beyond scanner processing limits), which strengthens rather than weakens the design-defect finding. Attributable to the platform operator.
(c) illicit diversion of control (hijacking) - the execution of malicious third-party payloads injected into the agent's active memory via compromised skill packages.
Attachment of liability: The malicious actors who developed the exploit are fully liable; the platform operator (ClawHub) is liable for design defects; the developers who installed unverified packages share liability if they violated safe deployment guidelines.
Procedural Mechanism
6.2 (architectural human confirmation): Installing or executing third-party packages and skills must require strict architectural human confirmation (e.g., cryptographic package validation and sandboxed behavior checks).
7.1 (independent forensics): All skill installations, execution logs, and script outputs must be logged in a secure, independent ledger to detect post-install anomalies.
9.4 (least privilege): Allowing an agent to execute third-party skills that inherit the agent's full permission set—filesystem, shell, credential stores and outbound network—violates the principle of least necessary access. Skills must execute in an isolated container or ephemeral VM with no path to corporate VPN, password managers or private keys.