ClawHub 技能市场被投毒：审计当时全部 2,857 个技能，检出 341 个恶意技能，335 个同属一场行动，以假「前置安装」投放 Atomic Stealer。 一句话（英）：ClawHub's skill marketplace was poisoned: an audit of all 2,857 listed skills found 341 malicious, 335 from a single campaign, using fake prerequisites to deliver Atomic Stealer.ClawHub's skill marketplace was poisoned: an audit of all 2,857 listed skills found 341 malicious, 335 from a single campaign, using fake prerequisites to deliver Atomic Stealer.

Koi Security researcher Oren Yomtov audited every skill then listed on ClawHub, 2,857 in total, and found 341 malicious skills, 335 of them belonging to a single campaign Koi named ClawHavoc (all figures are Koi's audit figures, checked verbatim against AIID reports 6951 and 6952 and the Cloud Security Alliance research brief). The malicious skills had been uploaded from January 27, 2026 onward. Each carried a "Prerequisites" section in its documentation that lured users into installing a supposedly required component first: Windows users were told to download a password protected archive, openclaw-agent.zip, from GitHub and run the program inside, a trojan with keylogging; macOS users were told to paste a code snippet hosted on glot.io into a terminal, which after Base64 obfuscation fetched a second stage payload from the attacker's server and installed Atomic Stealer (AMOS), taking keychain credentials, browser data, cryptocurrency wallets, Telegram sessions, SSH keys and files from common folders. The 335 campaign skills shared one command and control address, 91.92.242.30. Crypto tools were the largest lure category, followed by YouTube utilities and finance and social tools (Koi's classification). The publishing bar at the time was a GitHub account at least one week old, with no effective review. In an update two weeks later, Koi reported the registry had grown past 10,700 skills and its confirmed malicious count had risen to 824; that is a later figure and is not mixed with the first round 341. Some secondary articles give the audit base as 2,632, which conflicts with Koi's 2,857 and is not used.

The tool layer failure has two levels. On the surface it is marketplace gating: a near zero publishing bar and no effective review, while an installed skill runs with the agent's full permissions. Underneath sits the boundary between documentation and instructions: a SKILL.md is nominally documentation but in practice is instructions the agent executes, and the fake prerequisite wrote the malicious instruction into that document for the agent or the user to run by hand. Third party tools entered the execution environment with no provenance check and no content review, which is the tool gate. Evidence note: the primary source, Koi's original post, is offline (see the verification notes), so this entry is capped at multi-source verified, with its figures carried by three verbatim relays checked against each other.

A skill is an instruction：a SKILL.md is nominally documentation but in practice instructions the agent executes; review it as executable instruction, not as a document.

Gate the marketplace：third party skills pass provenance and content checks before entering the execution environment; the publishing bar cannot be account age alone.

Minimise install permissions：the default that an installed skill runs with the agent's full permissions has to change.