Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-06-28 · source-backed
This is the one that should make you re-audit your skill installs today.
Security firm AIR built a benign-looking but malicious agent skill, pushed it through a popular skill marketplace plus an Instagram ad, and reports it landed on roughly 26,000 agents. Some of those were corporate accounts. The detail that matters: every skill scanner AIR tested marked it safe (The Hacker News). Not "mostly safe." Safe. The scanners are the control we've been leaning on, and the control didn't fire.
Orca Security's "Skill Issues" research fills in the mechanics (Orca Security). Open skill marketplaces don't mandate semantic review, so heavily obfuscated intent rides into an agent's context through a channel the agent already trusts. One Orca proof-of-concept didn't even need clever obfuscation. It just inflated its own file size past the scanner's inspection threshold and walked straight past both ClawScan and VirusTotal. And this isn't theoretical. Antiy CERT confirmed 1,184 malicious skills live on ClawHub, 335 of them traced to a single coordinated operation they're calling ClawHavoc.
Here's the part that breaks your instinct. Download counts are gamed by bot-driven installs. So the two signals you'd naturally reach for, "lots of people use it" and "the scanner cleared it," are both compromised at the same time. Install counts and scan badges are not trust signals for agent skills. Full stop.
We've seen this movie before in package management. npm, PyPI, the whole supply-chain mess. We eventually got lockfiles, signatures, provenance, and scanning that actually correlated to risk. The skills ecosystem has roughly none of that maturity yet, and skills are arguably more dangerous than packages because they execute inside a reasoning loop with tool access, not inside a sandbox you designed.
What I'd do this week: treat every third-party skill like unsigned code from a stranger, because that's what it is. Pin exact versions. Read the actual skill body, not the description. Pair it with a runtime tool allow-list (more on that in Skills below) so a poisoned skill still can't exfiltrate or destroy anything, because detection alone clearly isn't holding. If you're on a corporate account, assume the 26,000 number includes someone in your org and go check.
Each link below shares sources, entities, or timing with this story.
OpenClaw released ClawHub / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (OpenClaw released ClawHub); both cover ClawHub, PyPI, The Hacker News; reported by the same outlet (thehackernews.com).
Linked by a graph relationship (OpenClaw released ClawHub); both cover ClawHavoc, ClawHub, The Hacker News; reported by the same outlet (thehackernews.com).
OpenClaw released ClawHub / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OpenClaw released ClawHub); both cover ClawHavoc, ClawHub, Skills; overlapping topics (maliciou, skill).
Orca Security criticizes Copilot / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Orca Security criticizes Copilot); both cover Install, Safe; overlapping topics (agent, security, skill).
Skills supports Claude Code / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Skills supports Claude Code); both cover Security, The Hacker News; reported by the same outlet (thehackernews.com).
Skills supports Claude Code / Shared entities / Same source domain / What happened next / Tension
Linked by a graph relationship (Skills supports Claude Code); both cover Full, The Hacker News; reported by the same outlet (thehackernews.com).
Orca Security criticizes Copilot / Shared entity: Full / Shared topic / What happened next
Linked by a graph relationship (Orca Security criticizes Copilot); both cover Full; overlapping topics (agent, security).
Meta criticizes Instagram / Shared entity: The Hacker News / Same source domain / What happened next
Linked by a graph relationship (Meta criticizes Instagram); both cover The Hacker News; reported by the same outlet (thehackernews.com).