Incident

ClawHavoc: anatomy of a skill-marketplace attack

In February 2026, ClawHub showed how an agent-skill marketplace gets weaponized: security researchers found over a thousand malicious skills — disguised, typosquatted, carrying credential theft and remote control.

~7 min read · Incident

What happened

Auditing the roughly 14,000 publicly listed ClawHub skills, researchers found 1,184 malicious ones — an infection rate of nearly 8.5%. 335 of them belonged to a single coordinated operation called ClawHavoc. The targets were macOS and Windows machines, especially always-on machines (such as Mac minis) where OpenClaw runs permanently as an agent host.

The tricks

Typosquatting: many skills imitated legitimate names — clawhubb, cllawhub, clawhubcli — to catch accidental installs from users clicking quickly through the marketplace.

Disguise: others posed as in-demand tools — crypto wallets, Polymarket trading bots, YouTube utilities, auto-updaters, Google Workspace integrations.

One skill that posed as a legitimate Polymarket tool secretly ran a command that gave the attacker full remote control over the system.

What the skills did

Credential theft: skills exfiltrated OpenClaw bot credentials from config files to external webhook services.
Remote code execution: hidden commands for full system control.
Persistence: the skill files stay in ~/.openclaw/skills — and are re-read at the start of every session.

Why "verified" wasn't enough

A marketplace checks origin and version — not intent. A typosquat is a perfectly "legitimate" upload. That's exactly the gap from Skills as the entry point: verification isn't security.

How PoisonZero stops this

PoisonZero operates one layer deeper than the marketplace — at write access. The daemon monitors ~/.openclaw/skills and the config files locally:

Every write is evaluated — even one from a "verified" skill.
If a disguised skill tries to exfiltrate credentials or write a poisoned memory, the access is blocked fail-closed and rolled back.
Meta-Attacks (skills that try to switch off the protection) are detected separately; everything lands in the audit trail.

More on the mechanism: Memory Poisoning and Supply-chain worms.

Protect your OpenClaw skills.

PoisonZero evaluates every write to ~/.openclaw/skills — and stops disguised skills fail-closed.

Try 14 days free

All articles