ClawHavoc: anatomy of a skill-marketplace attack

What happened

Auditing the roughly 14,000 publicly listed ClawHub skills, researchers found 1,184 malicious ones - an infection rate of nearly 8.5%. 335 of them belonged to a single coordinated operation called ClawHavoc. The targets were macOS and Windows machines, especially always-on machines (such as Mac minis) where OpenClaw runs permanently as an agent host.

The tricks

Typosquatting: many skills imitated legitimate names (clawhubb, cllawhub, clawhubcli) to catch accidental installs from users clicking quickly through the marketplace.

Disguise: others posed as in-demand tools - crypto wallets, Polymarket trading bots, YouTube utilities, auto-updaters, Google Workspace integrations.

What the skills did

• Credential theft: skills exfiltrated OpenClaw bot credentials from config files to external webhook services.
• Remote code execution: hidden commands for full system control.
• Persistence: the skill files stay in ~/.openclaw/skills - and are re-read at the start of every session.

Why "verified" wasn't enough

A marketplace checks origin and version - not intent. A typosquat is a perfectly "legitimate" upload. That's exactly the gap from Skills as the entry point: verification isn't security.

How PoisonZero protects you here

PoisonZero operates one layer deeper than the marketplace - at write access. The daemon monitors ~/.openclaw/skills and the config files locally and checks every change before it takes effect - a harmless edit passes, a dangerous one is reverted, an unclear one is brought to you to decide.

• Every write is evaluated - even one from a "verified" skill.
• If a disguised skill tries to exfiltrate credentials or write a poisoned memory, the change is reverted fail-closed with a full audit trail.
• Meta-Attacks (skills that try to switch off the protection) are detected separately; everything lands in the audit trail.

More on the mechanism: Memory Poisoning and Supply-chain worms.