ClawHub Malicious Skills Report — October 2026
What the public record says about malicious skills on ClawHub, the OpenClaw skill registry, drawn from the Ironheights tracker and benchmark #1. Every number below is counted from those datasets or quoted from the researcher who published it.
Key findings
- Documented cases
- 22
- Skills and campaigns
- 19
- Stated as removed
- 12
- Pattern flagged in full or part
- 16
Scale, in the researchers' own numbers
The tracker counts cases, not skills. Registry-wide figures come from the studies and campaign reports below; each links to its tracker entry and from there to the primary source.
- Koi Security audited all 2,857 skills then on ClawHub and reported 341 as malicious, 335 of them from one campaign it named ClawHavoc. (tracker entry)
- Koi's 16 February 2026 update raised the count to 824 as the registry grew past 10,700 skills. (tracker entry)
- Snyk's ToxicSkills study scanned 3,984 skills from ClawHub and skills.sh and confirmed 76 malicious payloads by hand; 534 skills (13.4%) had at least one critical issue. (tracker entry)
- Trend Micro identified 39 skills that told the agent to install a fake OpenClawCLI, which led to an Atomic macOS Stealer variant. (tracker entry)
- Bitdefender Labs found about 17% of the OpenClaw skills it analyzed in the first week of February 2026 behaving maliciously, 54% of those crypto-themed. (tracker entry)
- VirusTotal reported analysing more than 3,016 OpenClaw skills, including 314 tied to a single user. (tracker entry)
Techniques
Technique tags on the 19 skills and campaigns. One case can use several techniques, so the shares add up to more than 100%.
| Technique | Cases | Share of 19 |
|---|---|---|
| Encoded command | 12 | 63% |
| Fake prerequisite | 11 | 58% |
| Download piped to shell | 9 | 47% |
| Password-protected archive | 6 | 32% |
| Infostealer | 5 | 26% |
| Paste-site lure | 4 | 21% |
| Financial fraud | 3 | 16% |
| Lookalike website | 3 | 16% |
| Remote instructions | 2 | 11% |
| Scanner evasion | 2 | 11% |
| Typosquat | 2 | 11% |
| Affiliate injection | 1 | 5% |
| Bundled executable | 1 | 5% |
| Credential theft | 1 | 5% |
| Hidden in working code | 1 | 5% |
| Prompt injection | 1 | 5% |
| Reverse shell | 1 | 5% |
Status and coverage
| Measure | Cases |
|---|---|
| Status: Removed (as stated by a source) | 12 |
| Status: Unknown | 7 |
| Coverage: Covered | 6 |
| Coverage: Partly covered | 10 |
| Coverage: Not covered | 3 |
Reports by month first reported: February 2026: 14; March 2026: 1; April 2026: 1; June 2026: 3.
Benchmark #1 at a glance
| Scanner | Malicious flagged | Benign flagged |
|---|---|---|
| Ironheights 0.1.0 | 10/10 | 0/10 |
| Cisco skill-scanner 2.2.2 | 4/10 | 0/10 |
| VirusTotal | 0 of 20 samples flagged | — |
The corpus is 20 short synthetic skills we wrote (10 malicious, 10 benign). It is a regression check, not a real-world detection rate. Full details on the benchmark page.
All 22 cases
Methodology
- Inclusion. A case enters the tracker only with at least one published source: a vendor write-up, registry issue or news article. All 22 cases here have a primary source.
- Counting. “Cases” are tracker entries: single skills, campaigns (a group of skills reported together) and studies. Registry-wide totals are quoted from the source and not added together, because studies overlap.
- Dates. The date a case was first publicly reported, not when the skill was published.
- Status is the source's word. We did not check the registry ourselves.
- Coverage is tested: we rebuild the reported pattern as a harmless fixture and run the released scanner on it. We did not scan the original malware.
- Benchmark numbers come from benchmark #1, run on 9 October 2026, and are reproduced unchanged.
- Gaps. Only public reports are included. Absence from this report does not mean a skill is safe. See Limitations.
Report it on the tracker page. The live tracker changes; this report is a snapshot as of 10 October 2026. Read more on the blog.