How many malicious skills are in ClawHub?

Initial audit found 341 malicious skills (12% of 2,857 audited). Updated scans report 800+ malicious skills, approximately 20% of the entire registry.

What is the ClawHavoc campaign?

ClawHavoc is a coordinated malware operation traced to a single threat actor. 335 of the 341 initially discovered malicious skills belonged to this campaign, deploying Atomic Stealer (AMOS) to steal credentials from macOS users.

How can I check if my OpenClaw skills are safe?

OpenClaw now scans all ClawHub skills via VirusTotal partnership with daily re-scans. ClawSec provides integrity verification. Only install skills from trusted sources, and check for the verified badge after ClawHub launched skill screening.

What malware do malicious OpenClaw skills install?

The primary payload is Atomic Stealer (AMOS), a macOS information-stealing trojan available for $500-1,000/month on criminal markets. It targets browser passwords, cryptocurrency wallets, and system credentials.

Is ClawHub safe to use after the malware crisis?

ClawHub has improved security with VirusTotal scanning and verified skill screening. However, 20% malware rate means caution is still warranted. Only install verified skills, review code before installing, and monitor agent behavior.

← Back to dashboard

clawsmith.com/claw/openclaw-clawhub-341-malicious-skills

⚠ IssueUnderservedToolLive

1,467 malicious skills found in ClawHub marketplace — Snyk audit expands from 341 to 1,467

Snyk found 1,467 malicious skills in ClawHub (91% combining prompt injection with traditional malware). Originally 341 found by Koi Security in ClawHavoc campaign. Over 40,000 exposed instances running with insecure default configurations.

Virality Score

1,467

across 1 platforms

Score Breakdown

FORUMS

Social Proof 2 sources

Researchers Find 341 Malicious ClawHub Skills Stealing Data

2/2/2026

0 HN

VirusTotal Blog: From Automation to Infection - OpenClaw Skills Weaponized

2/15/2026

Existing Solutions 2 competitors

VirusTotal PartnershipOfficial integration

Official ClawHub scanning via VirusTotal threat intelligence with daily re-scans

ClawSec (Prompt Security)Open source

Skill integrity verification, drift detection, and automated security audits

Gap Assessment

UnderservedExisting solutions leave gaps

VirusTotal partnership provides daily scanning. ClawSec (Prompt Security) offers skill integrity verification. ClawSecure has behavioral engine. But no solution prevents upload of malicious skills proactively.

Frequently Asked Questions

Details

Signalissue

EcosystemTool

Sources2

Platforms1

Updated1h ago

Trend→ stable