Connect Clawsmith to your coding agent. Ship products like crazy.Unlimited usage during betaGet API Key →

← Back to dashboard

clawsmith.com/signal/snyk-toxicskills-1467-malicious-clawhub-prompt-injection

⚠ IssueCompetitiveLive

Snyk ToxicSkills: 36% of ClawHub Skills Have Prompt Injection, 1,467 Malicious Payloads

Snyk scanned 3,984 ClawHub skills and found 1,467 malicious payloads. 36% of all skills contain detectable prompt injection. 91% of confirmed malicious samples combine prompt injection with traditional malware.

Product Idea from this Signal

A security layer that vets ClawHub skills for malware and prompt injection before your agent installs them

ClawHub grew 380% to 13,729 skills in Q1 2026. Snyk found 36% contain prompt injection and 1,467 carry malicious payloads. The ClawHavoc campaign planted 1,184 weaponized skills in the marketplace. VirusTotal integration catches known malware but misses novel prompt injection, data exfiltration via tool outputs, and social engineering patterns unique to AI agent skills. This tool performs deep behavioral analysis of every skill before installation, catching threats that signature-based scanners miss.

SECURITYCLIDEVTOOLOPEN-SOURCE

CompetitiveView Opportunity →

Score Breakdown

HN

2,450

Reddit

2,350

Social Proof 2 sources

Snyk ToxicSkills: 36% of ClawHub skills have prompt injection

1467 malicious skills, 36% prompt injection — Snyk audit

Gap Assessment

CompetitiveMarket has established players

Snyk ToxicSkills Scanner, VirusTotal integration, and SecureClaw all address this space. Competitive.

Virality Score

4,800

across 3 platforms

Details

Signalissue

Ecosystem—

Sources2

Platforms3

Updated14d ago

Trend→ stable

Top ideas

26.1MA pre-publish scanner that strips source maps, secrets, and internal code from npm packages before they ship to the registry 2.2MA routing middleware that pairs an expensive advisor model with a cheap executor model for OpenClaw agents, cutting API costs by 80% while maintaining output quality 892.2KA web dashboard that finds revenue gaps and saturated niches across 180+ OpenClaw startups in real time

Related signals

All signals →

93KAgents of Chaos: 38 Researchers Deploy 6 OpenClaw Agents — 11 Critical Failure Patterns in 14 Days 35.7KCapability Evolver — #1 ClawHub Skill (35K Downloads) Caught Exfiltrating Data to ByteDance Feishu 13.3KIronClaw: NEAR AI Rust OpenClaw Rewrite — WASM Sandbox, LLM Never Touches Secrets (11.3K Stars)