BACK TO ARCHIVE
2026-04-02P0 CATASTROPHIC
CASE #0068

ClawHavoc: 824 Malicious Skills Published to ClawHub

In a coordinated supply-chain attack later named 'ClawHavoc', 824 malicious skills were uploaded to ClawHub in under 72 hours — representing roughly 20% of the entire marketplace — and targeted AI agent credentials, SSH keys, and cryptocurrency wallets across thousands of users before takedown.

CONFIRMED
🔓 SECURITY LEAK💾 DATA LOSS
Incident Brief

The ClawHavoc attack introduced 824 malicious skills to ClawHub over a ~72-hour period, many typo-squatting popular skill names (e.g., 'web-search-pro' vs. 'web-search'). Installed skills executed with full agent privileges by default, meaning any agent loading them gained access to SSH keys, stored API keys, browser cookies, and crypto wallet files on the host. Several skills opened reverse shells to attacker infrastructure. At 824 skills, the haul represented roughly 20% of ClawHub's entire listing — the largest single supply-chain event in OpenClaw's history.

Root Cause

The Actual Culprit

ClawHub required no author verification, no skill signing, and no manifest review. Skills executed with full agent capability by default — there was no permission model at the skill level.

What Was Done
[OK]Emergency takedown of 824 flagged skills
[OK]Author verification requirement for publishing
[OK]Skill signing introduced; unsigned skills disabled by default
[OK]Per-skill capability manifest required at install
[OK]Scanning pipeline for static + dynamic analysis pre-publish
Lessons Learned
package

A marketplace without signing is a payload delivery service

npm, PyPI, and every prior package ecosystem learned this the hard way. New ecosystems do not get a pass.

shield

Agent skills need a permission model

'Web search' and 'run arbitrary shell commands' should not be the same capability. Without manifest-declared, user-approved capabilities, every skill is a root exploit.

alert-triangle

Typo-squat detection is table stakes

Similarity checks on publish, download warning on edit-distance-1 collisions, and reserved-name lists should be built in from day one.

Comments (0)

Loading comments...

0/1000
Case Info
Case Number
#0068
Severity
💀P0 CATASTROPHIC
Severity Level
Date
2026-04-02
Affected Systems
ClawHub Marketplace
Skill Loader
Agent Runtime
Source
twitter
Published: 2026-04-02