{"title":"ClawHub Malicious Skills Report — October 2026","url":"https://www.ironheights.dev/reports/clawhub-malicious-skills-2026-10/","publisher":"Ironheights","date_published":"2026-10-12","data_as_of":"2026-10-10","license":"https://creativecommons.org/licenses/by/4.0/","summary":{"total":22,"reports":19,"skills":14,"campaigns":5,"studies":3,"removed":12,"unknown":7,"active":0,"covered":6,"partial":10,"notCovered":3,"techniques":[{"id":"encoded-command","label":"Encoded command","count":12},{"id":"fake-prerequisite","label":"Fake prerequisite","count":11},{"id":"pipe-to-shell","label":"Download piped to shell","count":9},{"id":"password-archive","label":"Password-protected archive","count":6},{"id":"infostealer","label":"Infostealer","count":5},{"id":"paste-site","label":"Paste-site lure","count":4},{"id":"financial-fraud","label":"Financial fraud","count":3},{"id":"lookalike-site","label":"Lookalike website","count":3},{"id":"remote-instructions","label":"Remote instructions","count":2},{"id":"scanner-evasion","label":"Scanner evasion","count":2},{"id":"typosquat","label":"Typosquat","count":2},{"id":"affiliate-injection","label":"Affiliate injection","count":1},{"id":"bundled-binary","label":"Bundled executable","count":1},{"id":"credential-exfiltration","label":"Credential theft","count":1},{"id":"hidden-in-code","label":"Hidden in working code","count":1},{"id":"prompt-injection","label":"Prompt injection","count":1},{"id":"reverse-shell","label":"Reverse shell","count":1}],"first":"2026-02-01","last":"2026-06-23","publishers":9,"sources":25,"byMonth":[["2026-02",14],["2026-03",1],["2026-04",1],["2026-06",3]]},"benchmark":{"runDate":"2026-10-09","corpus":{"total":20,"malicious":10,"benign":10,"maliciousBytes":"95–150","benignBytes":"168–252","families":{"exec":3,"credentials":2,"injection":2,"network":1,"persistence":1,"privilege":1}},"ihName":"Ironheights 0.1.0","ciscoName":"Cisco skill-scanner 2.2.2","ihRecall":"10/10","ihFp":"0/10","ciscoRecall":"4/10","ciscoFp":"0/10","vtFlagged":0},"key_findings":[{"id":"count","text":"As of 10 October 2026, the Ironheights tracker lists 22 publicly documented cases: 14 individual malicious skills, 5 campaigns and 3 registry-wide studies, backed by 25 cited sources from 9 publishers.","source":"Ironheights tracker (tracker.json)"},{"id":"techniques","text":"The most common techniques across the 19 skills and campaigns were encoded command (12 cases), fake prerequisite (11 cases), download piped to shell (9 cases).","source":"Ironheights tracker, technique tags"},{"id":"status","text":"Sources say 12 of the 19 skills and campaigns were removed; for the other 7, no source we found states their status.","source":"Ironheights tracker, status as stated by the source"},{"id":"coverage","text":"Ironheights rules flag the reported pattern in full for 6 of the 19 cases and in part for 10; for 3, no rule fires on the pattern or the skill file holds nothing a rule could match.","source":"Ironheights tracker, coverage tested on harmless rebuilt fixtures"},{"id":"benchmark","text":"In Ironheights benchmark #1 (9 October 2026), Ironheights 0.1.0 flagged 10/10 malicious test skills for review with 0/10 false positives; Cisco skill-scanner 2.2.2 flagged 4/10, and VirusTotal flagged 0 of 20.","source":"Ironheights benchmark #1 (benchmark.json)"}],"source_figures":[{"entry":"clawhavoc","figure":"341","text":"Koi Security audited all 2,857 skills then on ClawHub and reported 341 as malicious, 335 of them from one campaign it named ClawHavoc.","page":"https://www.ironheights.dev/tracker/clawhavoc/"},{"entry":"clawhavoc","figure":"824","text":"Koi's 16 February 2026 update raised the count to 824 as the registry grew past 10,700 skills.","page":"https://www.ironheights.dev/tracker/clawhavoc/"},{"entry":"snyk-toxicskills","figure":"76","text":"Snyk's ToxicSkills study scanned 3,984 skills from ClawHub and skills.sh and confirmed 76 malicious payloads by hand; 534 skills (13.4%) had at least one critical issue.","page":"https://www.ironheights.dev/tracker/snyk-toxicskills/"},{"entry":"trendmicro-amos-openclawcli","figure":"39","text":"Trend Micro identified 39 skills that told the agent to install a fake OpenClawCLI, which led to an Atomic macOS Stealer variant.","page":"https://www.ironheights.dev/tracker/trendmicro-amos-openclawcli/"},{"entry":"bitdefender-17pct","figure":"17%","text":"Bitdefender Labs found about 17% of the OpenClaw skills it analyzed in the first week of February 2026 behaving maliciously, 54% of those crypto-themed.","page":"https://www.ironheights.dev/tracker/bitdefender-17pct/"},{"entry":"virustotal-code-insight","figure":"3,016","text":"VirusTotal reported analysing more than 3,016 OpenClaw skills, including 314 tied to a single user.","page":"https://www.ironheights.dev/tracker/virustotal-code-insight/"}],"entries":[{"id":"letssendit","name":"letssendit (agentic front-running)","kind":"skill","date_reported":"2026-06-23","reporter":"Palo Alto Networks Unit 42","primary_source":"https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/","status":"Removed","coverage":"Not covered","rule_ids":"","techniques":"financial-fraud remote-instructions","page":"https://www.ironheights.dev/tracker/letssendit/"},{"id":"money-radar","name":"money-radar (runtime affiliate injection)","kind":"skill","date_reported":"2026-06-23","reporter":"Palo Alto Networks Unit 42","primary_source":"https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/","status":"Removed","coverage":"Partly covered","rule_ids":"IH-NET-001","techniques":"remote-instructions affiliate-injection financial-fraud","page":"https://www.ironheights.dev/tracker/money-radar/"},{"id":"tradingview-cluw","name":"TradingView assistant skills delivering the cluw stealer","kind":"skill","date_reported":"2026-06-23","reporter":"Palo Alto Networks Unit 42","primary_source":"https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/","status":"Removed","coverage":"Partly covered","rule_ids":"IH-NET-001","techniques":"fake-prerequisite paste-site encoded-command infostealer","page":"https://www.ironheights.dev/tracker/tradingview-cluw/"},{"id":"soroban-trader","name":"soroban-trader-skill and burhanclaw-soroban-trader","kind":"skill","date_reported":"2026-04-14","reporter":"Community report on GitHub (Rayzar)","primary_source":"https://github.com/openclaw/clawhub/issues/1664","status":"Unknown","coverage":"Not covered","rule_ids":"","techniques":"financial-fraud prompt-injection","page":"https://www.ironheights.dev/tracker/soroban-trader/"},{"id":"omnicogg","name":"omnicogg (22 MB padded README)","kind":"skill","date_reported":"2026-03-06","reporter":"JFrog Security Research","primary_source":"https://research.jfrog.com/post/omnicogg-malicious-skill/","status":"Removed","coverage":"Not covered","rule_ids":"","techniques":"scanner-evasion encoded-command pipe-to-shell infostealer","page":"https://www.ironheights.dev/tracker/omnicogg/"},{"id":"trendmicro-amos-openclawcli","name":"Skills distributing an Atomic macOS Stealer variant","kind":"campaign","date_reported":"2026-02-23","reporter":"Trend Micro","primary_source":"https://www.trendmicro.com/en/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html","status":"Removed","coverage":"Partly covered","rule_ids":"IH-NET-001","techniques":"fake-prerequisite lookalike-site encoded-command infostealer","page":"https://www.ironheights.dev/tracker/trendmicro-amos-openclawcli/"},{"id":"stveenli-openclawcli-forum","name":"copywritings and airbnb by StveenLi","kind":"skill","date_reported":"2026-02-10","reporter":"Community reports on GitHub (loganaden)","primary_source":"https://github.com/openclaw/clawhub/issues/190","status":"Removed","coverage":"Partly covered","rule_ids":"IH-NET-001","techniques":"fake-prerequisite lookalike-site encoded-command","page":"https://www.ironheights.dev/tracker/stveenli-openclawcli-forum/"},{"id":"google-qx4","name":"google-qx4 (fake openclaw-core requirement)","kind":"skill","date_reported":"2026-02-10","reporter":"Snyk","primary_source":"https://snyk.io/blog/clawhub-malicious-google-skill-openclaw-malware/","status":"Unknown","coverage":"Partly covered","rule_ids":"IH-NET-001","techniques":"fake-prerequisite paste-site password-archive","page":"https://www.ironheights.dev/tracker/google-qx4/"},{"id":"openclawcli-vercel","name":"Fake “OpenClawCLI” website lure (thiagoruss0, stveenli)","kind":"campaign","date_reported":"2026-02-09","reporter":"OpenSourceMalware","primary_source":"https://opensourcemalware.com/blog/malicious-clawhub-skills-use-external-websites-to-hide-in-plain-sight","status":"Unknown","coverage":"Partly covered","rule_ids":"IH-NET-001","techniques":"fake-prerequisite lookalike-site encoded-command scanner-evasion","page":"https://www.ironheights.dev/tracker/openclawcli-vercel/"},{"id":"bitdefender-17pct","name":"Bitdefender Labs analysis of OpenClaw skills","kind":"study","date_reported":"2026-02-05","reporter":"Bitdefender Labs","primary_source":"https://www.bitdefender.com/en-us/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap","status":"Unknown","coverage":"Not assessed","rule_ids":"","techniques":"infostealer credential-exfiltration encoded-command","page":"https://www.ironheights.dev/tracker/bitdefender-17pct/"},{"id":"security-check-nanopdf","name":"security-check (security-audit) and nanopdf","kind":"skill","date_reported":"2026-02-05","reporter":"Community report on GitHub (Jeff Schell)","primary_source":"https://github.com/openclaw/clawhub/issues/135","status":"Removed","coverage":"Covered","rule_ids":"IH-EXEC-001","techniques":"encoded-command pipe-to-shell","page":"https://www.ironheights.dev/tracker/security-check-nanopdf/"},{"id":"snyk-toxicskills","name":"ToxicSkills study","kind":"study","date_reported":"2026-02-05","reporter":"Snyk","primary_source":"https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/","status":"Unknown","coverage":"Not assessed","rule_ids":"","techniques":"prompt-injection credential-exfiltration pipe-to-shell","page":"https://www.ironheights.dev/tracker/snyk-toxicskills/"},{"id":"zaycv-more","name":"More skills by zaycv: linkedin-job-application, autoupdater, deepresearch","kind":"skill","date_reported":"2026-02-04","reporter":"Community reports on GitHub (adrianwedd, hendrysadrak, rafadiasbsb)","primary_source":"https://github.com/openclaw/clawhub/issues/124","status":"Removed","coverage":"Covered","rule_ids":"IH-EXEC-001 IH-PRIV-001 IH-NET-001","techniques":"fake-prerequisite encoded-command pipe-to-shell password-archive","page":"https://www.ironheights.dev/tracker/zaycv-more/"},{"id":"zaycv-clawhub-cli","name":"Fake “ClawHub CLI” skills by zaycv (clawhub, clawdhub1)","kind":"skill","date_reported":"2026-02-02","reporter":"Snyk; GitHub issue by lycfyi","primary_source":"https://github.com/openclaw/clawhub/issues/108","status":"Removed","coverage":"Partly covered","rule_ids":"IH-EXEC-001 IH-NET-001","techniques":"typosquat fake-prerequisite encoded-command pipe-to-shell paste-site password-archive","page":"https://www.ironheights.dev/tracker/zaycv-clawhub-cli/"},{"id":"virustotal-code-insight","name":"VirusTotal Code Insight findings on OpenClaw skills","kind":"study","date_reported":"2026-02-02","reporter":"VirusTotal","primary_source":"https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html","status":"Unknown","coverage":"Not assessed","rule_ids":"","techniques":"fake-prerequisite password-archive","page":"https://www.ironheights.dev/tracker/virustotal-code-insight/"},{"id":"moonshine-100rze","name":"WhatsApp and security-check lookalikes by moonshine-100rze","kind":"skill","date_reported":"2026-02-02","reporter":"Community reports on GitHub (diegofornalha, biagiom)","primary_source":"https://github.com/openclaw/clawhub/issues/109","status":"Removed","coverage":"Covered","rule_ids":"IH-EXEC-001 IH-NET-001","techniques":"encoded-command pipe-to-shell fake-prerequisite","page":"https://www.ironheights.dev/tracker/moonshine-100rze/"},{"id":"authtool","name":"“AuthTool” trading skills","kind":"campaign","date_reported":"2026-02-01","reporter":"Koi Security","primary_source":"https://web.archive.org/web/20260210212946/https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting","status":"Unknown","coverage":"Partly covered","rule_ids":"IH-EXEC-001 IH-NET-001","techniques":"fake-prerequisite password-archive encoded-command pipe-to-shell","page":"https://www.ironheights.dev/tracker/authtool/"},{"id":"clawhavoc","name":"ClawHavoc","kind":"campaign","date_reported":"2026-02-01","reporter":"Koi Security","primary_source":"https://web.archive.org/web/20260210212946/https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting","status":"Unknown","coverage":"Partly covered","rule_ids":"IH-EXEC-001 IH-NET-001","techniques":"fake-prerequisite encoded-command pipe-to-shell paste-site password-archive typosquat infostealer","page":"https://www.ironheights.dev/tracker/clawhavoc/"},{"id":"osm-first-wave","name":"Malicious ClawHub skills targeting crypto and trading users","kind":"campaign","date_reported":"2026-02-01","reporter":"OpenSourceMalware (Paul McCarty)","primary_source":"https://opensourcemalware.com/blog/malicious-clawhub-skills-target-openclaw-users","status":"Unknown","coverage":"Partly covered","rule_ids":"IH-EXEC-001 IH-NET-001","techniques":"fake-prerequisite encoded-command pipe-to-shell password-archive infostealer","page":"https://www.ironheights.dev/tracker/osm-first-wave/"},{"id":"polymarket-backdoor","name":"Polymarket skills with a hidden reverse shell","kind":"skill","date_reported":"2026-02-01","reporter":"Koi Security; community report on GitHub (NCC-David)","primary_source":"https://web.archive.org/web/20260210212946/https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting","status":"Removed","coverage":"Covered","rule_ids":"IH-EXEC-001 IH-EXEC-003 IH-NET-001","techniques":"reverse-shell pipe-to-shell hidden-in-code","page":"https://www.ironheights.dev/tracker/polymarket-backdoor/"},{"id":"rankaj","name":"rankaj (credential exfiltration)","kind":"skill","date_reported":"2026-02-01","reporter":"Koi Security","primary_source":"https://web.archive.org/web/20260210212946/https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting","status":"Unknown","coverage":"Covered","rule_ids":"IH-CRED-001 IH-NET-001","techniques":"credential-exfiltration","page":"https://www.ironheights.dev/tracker/rankaj/"},{"id":"x-trends-nvdfx","name":"x-trends-nvdfx (bundled Windows executable)","kind":"skill","date_reported":"2026-02-01","reporter":"Community report on GitHub (plgonzalezrx8)","primary_source":"https://github.com/openclaw/clawhub/issues/93","status":"Removed","coverage":"Covered","rule_ids":"IH-BIN-001","techniques":"bundled-binary","page":"https://www.ironheights.dev/tracker/x-trends-nvdfx/"}]}