ClawHavoc: hundreds of malicious skills on ClawHub
In shortSkills on OpenClaw's marketplace told users to install a fake prerequisite that was an infostealer.
What happened
Koi Security audited 2,857 skills on ClawHub, the skill marketplace for OpenClaw (formerly Clawdbot and Moltbot), and found 341 malicious ones. It tied 335 of them to one campaign, which it named ClawHavoc.
The skills posed as crypto trackers, YouTube utilities, auto-updaters and Google Workspace integrations, many under typosquatted names. Their instructions walked the user through a fake prerequisite install that delivered the Atomic macOS Stealer.
Why it worked
A skill is text the agent follows. It needs no exploit: it asks, and the person or the agent does the rest through the normal install path.
What EndLayer shows or does
- Available now
Skills and commands listed per agent host, by name and origin, where the host is in your catalogue; you can add a host in the console. Roadmap →
- Available now
Optional scoring of a skill's contents for risk, which an administrator switches on because the text goes to a third-party provider. Roadmap →
- Planned
Removing a blocked skill from the device. Today a blocked skill fails the device. Roadmap →
- Not covered
The stealer itself is malware; stopping it is your endpoint protection's job. EndLayer checks that endpoint protection is present.