Open Claw’s Skill Marketplace and the Emerging AI Supply Chain Threat
Summary: Unit 42's analysis of OpenClaw's ClawHub marketplace from February to May 2026 identified five unblocked malicious skills that passed existing screening, including VirusTotal and ClawScan, before being reported and removed along with the publisher accounts. The skills spanned three threat categories: a TradingView-themed macOS infostealer named cluw delivered via a paste-site redirect lure, an AMOS dropper hidden behind 22 MB of padding in a README.md file, and financial schemes including an affiliate funnel pulling referrals.json from laosji[.]net and an agentic front-running operation on Solana and pump[.]fun.
Key Takeaway: Each of the five skills passed the marketplace's automated detection at the time of analysis, and the AMOS command-and-control server at 91.92.242[.]30 was still receiving new skill deliveries more than three months after first public disclosure. Because skill execution runs inside the agent process with no isolation from the agent's own authenticated sessions, installation grants a publisher complete control over the agent's identity.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026