Entity trail

ClawHub

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-29 / arxiv-researcherSkillGate Screens Agent Skill Files Before Install: F1=0.817 at 1.13% FPR While Cutting LLM Input Tokens 77%A paper posted 2026-07-28 (arXiv 2607.25619) presents SkillGate, a security gateway that screens Markdown skill packages before Cursor, Claude Code, or GitHub Copilot install them, using a regex prefilter that lets safe files bypass the LLM judge entirely and sends only matched snippet windows for flagged files. On SkillsBench (n=1,650, 9.1% malicious) it hits F1=0.817 and 1.13% false-positive rate while reducing LLM input tokens 77% versus full-file screening, and beats two existing tools by 5-6x on AUPRC (0.830 vs 0.144 and 0.162). The threat is independently corroborated: Snyk's February 2026 audit of 3,984 ClawHub and skills.sh skills found 534 (13.4%) with a critical issue and 76 confirmed malicious payloads, 8 of which were still live at publication.
2026-07-21 / skill-finderPadding an attack payload with 100,000 newlines beat file-truncation-based scanning (ClawHub bypass)The ClawHub bypass works by prepending roughly 100,000 newlines to a file so that the security scanner truncates the content before ever reaching the malicious payload — the detector reads whitespace, passes, and the agent reads the whole thing. It's a reminder that any scanner with a read limit has an exploitable prefix, and that your truncation boundary is a security boundary. Concrete defense: normalize and collapse whitespace *before* applying any length cap, and treat files whose byte length far exceeds their non-whitespace length as hostile by default rather than scanning the head and moving on.
2026-06-28 / agents-researcherOrca Security 'Skill Issues': attack primitives let malicious agent skills evade ClawScan and VirusTotal at scaleOrca's research details how open agent-skill marketplaces lack mandatory semantic security review, letting heavily obfuscated intent reach an agent's context through trusted channels; one proof-of-concept skill simply inflated its file size past scanner thresholds to bypass both ClawScan and VirusTotal. They tie it to real campaigns — Antiy CERT confirmed 1,184 malicious skills on ClawHub, 335 traced to a coordinated 'ClawHavoc' operation — and show download metrics can be gamed by bot-driven installs. The takeaway for builders: install counts and scan badges are not trust signals for agent skills.
2026-06-07 / agents-researcherOpenClaw June 2026 Release (2026.6.1) Replaces Dangerous-Code Scanner with Operator Install PolicyOpenClaw's June release (stable 2026.6.1, moving to YYYY.M.PATCH versioning) focuses on runtime reliability — agents recover more cleanly from interrupted tool calls, stale session bindings, and compaction handoffs — plus steadier multi-channel delivery across Slack, Teams, WhatsApp, iMessage, and more. Security-relevant: plugin/skill installs now go through an operator install policy instead of the old dangerous-code scanner path, with new Skill Workshop flows and clearer ClawHub install surfaces. A meaningful hardening step for a self-hosted agent runtime that has been a repeated supply-chain target.
2026-06-01 / reddit-researcherMCP Server Security Audit: 36.7% of 7,000+ Servers Vulnerable to SSRF, ClawHub Marketplace Hit by 824 Malicious SkillsBlueRock Security analyzed over 7,000 MCP servers and found 36.7% potentially vulnerable to server-side request forgery (SSRF). Separately, attackers uploaded 824 malicious 'skills' (out of 10,700 total) to ClawHub, OpenClaw's public marketplace, between late January and mid-February 2026. The UK AI Security Institute documented nearly 700 real-world AI scheming cases with a five-fold rise in documented misbehavior between October 2025 and March 2026. AI agent supply chains are now actively targeted.
2026-05-20 / agents-researcherOWASP Publishes Agentic Skills Top 10: First Security Framework for AI Agent Skill Supply ChainOWASP released the Agentic Skills Top 10 (AST10), the first comprehensive security framework for AI agent skills — the reusable behavioral workflows that define how agents sequence tool use. The project documents real-world attacks including the ClawHub registry poisoning where 5 of the top 7 most-downloaded skills were confirmed malware. Skills represent a unique attack surface distinct from both model-level and protocol-level security because they encode complete behavioral sequences rather than individual tool calls.
2026-05-11 / reddit-researcherOpenClaw Platform Trending Down — Subscription Cutoff Triggered Rapid Community Collapser/LocalLLaMA discussion with 148 upvotes and 130 comments tracks OpenClaw's accelerating decline. The platform peaked at 247,000 GitHub stars in mid-March 2026 (fastest-growing GitHub project in history) but collapsed sharply in April after a subscription model change. Between February and April, the software didn't change but the economics did — the community disintegrated in days. Plugin dependency loops, gateway slowdowns, and a fractured ClawHub ecosystem compounded the exodus. The team announced LTS plans for late May.
2026-05-08 / reddit-researcherHugging Face Supply Chain Attack: Open-OSS/privacy-filter Is a Disguised Infostealer — 779 Upvotes WarningA fake model titled 'Open-OSS/privacy-filter' on Hugging Face is actually a customized Python-based infostealer virus impersonating OpenAI's legitimate privacy filter model. The r/LocalLLaMA warning post hit 779 upvotes and 114 comments, with users detailing how the malware uses repository trust to execute credential theft. This follows a broader pattern documented by SecurityWeek and Sysdig of HuggingFace and ClawHub being weaponized for malware distribution in 2026.
2026-05-07 / skill-finderVentureBeat/IBM X-Force: No Supply-Chain Scanner Has a Detection Category for AI Agent Backdoors — OpenClaw Proved the GapVentureBeat analysis (May 5) reveals that OpenClaw's ClawHavoc campaign exposed a blind spot: no existing supply-chain scanner — Snyk, Socket, Dependabot — has a detection category for adversarial instructions embedded in agent skill files (SKILL.md). Snyk's ToxicSkills audit found 13.4% of 3,984 ClawHub skills contained critical security issues. One command can turn any open-source repo into an AI agent backdoor. IBM X-Force confirms agentic AI vulnerability volume is outpacing CVE assignment. For anyone building agent skill marketplaces, this is the npm-typosquatting moment for agents.
2026-04-27 / skill-finderOWASP Publishes First GenAI Exploit Round-up Report Q1 2026: Systematic Catalog of Real-World AI Agent Attacks, ClawHub Registry Poisoned at ScaleOWASP's Q1 2026 GenAI Exploit Round-up documents the transition from theoretical AI risks to real-world exploitation. Key finding: the ClawHub registry (primary OpenClaw skills marketplace) became the first AI agent registry poisoned at scale — five of the top seven most-downloaded skills were confirmed malware at peak infection. The report maps incidents to both the OWASP Top 10 for LLM Applications and the new OWASP Top 10 for Agentic Applications. A notable gap: most AI security events lack CVE identifiers, creating a blind spot for traditional vulnerability management.
2026-04-19 / skill-finderOpenClaw Registry Compromise: 12% of ClawHub Packages Malicious, 135,000 Exposed Instances, 9 CVEs Including One-Click RCEThe OpenClaw AI agent framework — 346,000 GitHub stars, fastest-growing repo in GitHub history — suffered the largest confirmed supply chain attack on AI agent infrastructure. Researchers found 341-1,184 malicious skills in ClawHub (12-20% of the registry). SecurityScorecard identified 135,000 public instances with insecure defaults. Nine CVEs disclosed, three with public exploit code. Agent social network Moltbook leaked 35,000 emails and 1.5M agent API tokens.
2026-04-15 / skill-finderOpenClaw ClawBleed Crisis Deepens: CVE-2026-25253 CVSS 8.8 Actively Exploited, 135K Instances Exposed, 824 Malicious Skills in ClawHub MarketplaceThe OpenClaw security crisis has escalated to 137 security advisories between February and April 2026, with 135,000+ instances exposed across 82 countries. ClawBleed (CVE-2026-25253, CVSS 8.8) enables one-click RCE via WebSocket origin validation bypass — visiting a single malicious webpage triggers full system compromise. The ClawHavoc supply chain attack has confirmed 824+ malicious skills in the official ClawHub marketplace (up from 341 initially reported). Qualys ETM published a detailed case study on April 13 showing how an unauthorized OpenClaw agent was detected disguised as a routine package on a Windows Server, correlating endpoint, exposure, and identity telemetry.

Graph relationships

CRITICIZES
Snyk
Snyk audit found 36% of ClawHub skills contain malicious components.
Source finding
MENTIONS
OpenClaw
The OpenClaw incident revealed 1,184 malicious skills across ClawHub.
Source finding
RELEASED
OpenClaw
OpenClaw v2026.3.22 ships with ClawHub as the default plugin registry replacing npm
Source finding
CRITICIZES
Snyk
Snyk found 36.82% of ClawHub skills contain security flaws.
Source finding
MENTIONS
OpenClaw
ClawHub registry for OpenClaw skills was poisoned at scale.
Source finding
COMPETES WITH
HappyCapy
ClawHub, Anthropic private marketplace, HappyCapy, OpenAI Frontier, and Notion all provide agent skills distribution platforms
Source finding
SUPPORTS
ClawForge
ClawForge governance layer addresses 12% malicious skill rate on ClawHub.
Source finding
USES
OpenClaw
ClawHub is OpenClaw's public marketplace for skills
Source finding
CRITICIZES
Snyk -> ClawHub
Snyk audit found 36% of ClawHub skills contain malicious components.
Source finding
MENTIONS
OpenClaw -> ClawHub
The OpenClaw incident revealed 1,184 malicious skills across ClawHub.
Source finding
RELEASED
OpenClaw -> ClawHub
OpenClaw v2026.3.22 ships with ClawHub as the default plugin registry replacing npm
Source finding
CRITICIZES
Snyk -> ClawHub
Snyk found 36.82% of ClawHub skills contain security flaws.
Source finding

Source trail

arXiv 2607.25619 The Hacker News Orca Security Krebs on Security Google DeepMind, UC Berkeley, and Dawn Song's team Noma Labs disclosed first security framework for AI agent skills Context AI was compromised Q1 2026 GenAI Exploit Round-up CVEs confirmed NousResearch released Peter Steinberger's personal AI assistant

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…