OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

1. Executive summary

OpenClaw's ClawHub marketplace has been found hosting five malicious "skills" (agent plugins) that bypassed both VirusTotal and OpenClaw's proprietary ClawScan scanner during February–May 2026. The skills fall into three categories: macOS infostealers with command-and-control (C2) connectivity, evasion techniques using inflated file sizes to exceed scanner thresholds, and two novel agentic threats (runtime affiliate injection and agentic front-running) used for financial fraud. Trail of Bits separately demonstrated that all major public-marketplace scanners (ClawHub, Cisco, and three scanners integrated into skills.sh) can be bypassed in under an hour using simple techniques such as prepending 100,000 newlines to a skill file. EMEA financial services firms deploying OpenClaw agents, or any agent that consumes skills from public marketplaces, face a credible AI supply-chain risk that can lead to credential theft, agent hijacking, and direct financial fraud. Attribution for the five Unit 42 skills is not publicly attributed to a named actor; the AMOS distribution infrastructure observed in earlier waves is associated with the Atomic macOS Stealer family.

2. Regulatory framing

DORA Art. 17, Art. 19, Art. 24, Art. 29, Art. 30 and NIS2 Art. 23 are not directly engaged by the facts in this item unless a specific incident occurs; they become live obligations on actual compromise or on entering a contractual relationship with the provider.

3. Technical analysis & attack chain

Confirmed attack chain (Unit 42, Feb–May 2026)

1. Initial access — supply-chain distribution. Threat actor publishes a malicious skill to ClawHub (clawhub.ai). The skill is a markdown-driven package (SKILL.md plus supporting files) that the OpenClaw agent will execute with broad local system access.
2. Scanner evasion. The skill evades ClawHub's two-part scanning stack: - VirusTotal integration (signature checks + Gemini 3 Flash-based "Code Insight"). - ClawScan, OpenClaw's custom harness using a guard model (default GPT 5.5). Evasion techniques observed include inflating file size to exceed scanner thresholds and (per Trail of Bits) prepending 100,000 newlines between boilerplate and malicious content — the OpenClaw scanner truncates and misses the payload; the VirusTotal model becomes confused.
3. Execution / payload delivery. Once installed, the skill performs one of: - macOS infostealer deployment — drops an AMOS-family stealer that connects to C2 infrastructure (persistent threat-actor activity). - Agentic affiliate injection — runtime technique that hijacks the agent's transactional context for financial gain. - Agentic front-running — novel technique that exploits the agent's authority to execute financial actions ahead of legitimate users.
4. Persistence / C2. Infostealer variants establish C2 connectivity to attacker-controlled infrastructure (IP 91.92.242[.]30 observed in earlier AMOS campaigns; paste-site intermediaries glot[.]io and rentry[.]co used to update payloads without modifying the published skill).
5. Impact. Credential theft, agent identity hijack, and direct financial fraud via the two agentic techniques.

Earlier (Feb 2026) wave — still relevant for detection

• ~17% of OpenClaw skills analysed by Bitdefender Labs in the platform's first weeks carried malicious payloads.
• Koi Security's "ClawHavoc" disclosure documented 341 malicious skills.
• Trend Micro confirmed Atomic macOS Stealer (AMOS) distribution.
• Dropper technique: Base64-encoded curl | bash payload, often disguised as a "prerequisite" instruction to the agent.
• macOS targets served via paste-site redirects (glot[.]io, rentry[.]co); Windows targets directed to password-protected executables on third-party hosts.

Defender-relevant technical specifics

• Component: OpenClaw agent + ClawHub marketplace (clawhub.ai).
• Skill format: Markdown-driven packages (SKILL.md) with arbitrary code; no isolation between skill logic and agent authority.
• Scanner stack bypassed: VirusTotal (Code Insight on Gemini 3 Flash) + ClawScan (GPT 5.5 guard model).
• Bypass primitives confirmed: whitespace padding (100,000 newlines), file-size inflation, prompt-injection in natural-language skill content.
• Distribution channels at risk: public marketplaces (clawhub.ai, skills.sh); ZIP archives distributed out-of-band and uploaded manually or via API to Anthropic's claude.ai and OpenAI's Codex.
• C2 / payload infrastructure (earlier wave, still active indicators): 91.92.242[.]30 (AMOS C2); glot[.]io and rentry[.]co as redirect intermediaries.

Caveats

• The five Unit 42 skills were reported and taken down; OpenClaw banned the associated accounts. Whether any of the five were installed by victims before takedown is not stated in the source material.
• Attribution for the five skills is not publicly linked to a named APT in the source material; treat any "APT-X did this" claim as unconfirmed.
• Trail of Bits' scanner-bypass results are reproducible but were tested against scanner versions current at the time of their June 2026 publication; vendors may have updated since.

4. Mitigation & containment

P1 — within 24 hours

• Block public-marketplace skill installation. Disable or block installation of skills from clawhub.ai and skills.sh on production OpenClaw deployments until a reviewed allowlist is in place. Where the agent harness supports it, restrict skill sources to curated marketplaces (anthropics/skills, trailofbits/skills-curated) or internal repositories only.
• Audit installed skills. Enumerate every skill currently installed on OpenClaw agents in scope; cross-reference against the OpenClaw takedown list and the Koi "ClawHavoc" 341-skill set; remove any match.
• Hunt for AMOS indicators. Search endpoint telemetry for connections to 91.92.242[.]30 and for paste-site redirect chains involving glot[.]io or rentry[.]co followed by executable download on macOS hosts.

P2 — within 72 hours

• Egress controls. Add 91.92.242[.]30 to deny lists at the perimeter and in DNS security; add glot[.]io and rentry[.]co to URL filtering deny lists where business use is not required.
• Process controls. On macOS endpoints, block or alert on curl | bash, base64 -d | sh, and osascript invocations originating from agent runtimes or unfamiliar parent processes.
• Agent runtime hardening. Run OpenClaw agents under a dedicated low-privilege user; restrict access to credential managers, shell, and file system outside an explicit working directory; require human-in-the-loop confirmation for any skill that requests network egress or financial action.

P3 — within 7 days

• Vendor engagement. Confirm with OpenClaw which of the five reported skills were downloaded by your tenants prior to takedown and request the new NVIDIA-backed documentation/analysis pipeline as part of your third-party due diligence (DORA Art. 28).
• Scanner validation. Do not rely solely on VirusTotal/Code Insight or ClawScan for skill vetting; require a second human review for any skill touching production data or financial workflows.
• Policy update. Add "AI agent skill provenance" to the third-party risk register and incident-response playbooks.

5. Indicators of compromise

ipv4  91.92.242.30
domain  glot.io
domain  rentry.co

6. Detection

Sigma rule — suspicious skill-installation and dropper activity

title: OpenClaw Skill Dropper Activity (curl|bash, base64|sh)
id: 8a3f1c2e-4b5d-4e6a-9f7b-1c2d3e4f5a6b
status: experimental
description: |
  Detects Base64-decoded pipe-to-shell and curl-pipe-bash patterns associated
  with OpenClaw malicious skill droppers, including paste-site redirect
  intermediaries (glot.io, rentry.co).
author: Adverse Trace
date: 2026-06-24
references:

  - https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/
logsource:
  product: process_creation
  category: process_creation
detection:
  selection_b64_pipe:
    CommandLine|contains:

      - "base64 -d"
      - "base64 --decode"
    CommandLine|contains:

      - "| sh"
      - "| bash"
      - "| zsh"
  selection_curl_pipe:
    CommandLine|contains:

      - "curl"
    CommandLine|contains:

      - "| sh"
      - "| bash"
      - "| zsh"
  selection_paste_redirect:
    CommandLine|contains:

      - "glot.io"
      - "rentry.co"
  parent_agent:
    ParentImage|endswith:

      - "openclaw"
      - "clawhub"
      - "codex"
      - "claude"
  condition: (selection_b64_pipe or selection_curl_pipe or selection_paste_redirect) and parent_agent
level: high

YARA rule — suspicious whitespace padding in skill packages

rule OpenClaw_MaliciousSkill_WhitespacePadding
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-24"
        description = "Detects SKILL.md or skill-package files padded with excessive newlines, the documented ClawHub scanner-bypass primitive"
        reference = "https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/"

    strings:
        $skill_md = "SKILL.md" ascii
        $newline_run = /\n{1000,}/

    condition:
        $skill_md and $newline_run
}

7. Sources

• Palo Alto Networks Unit 42 — OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat — https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/ — 2026-06-23
• Trail of Bits — The sorry state of skill distribution — https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/ — 2026-06-03

8. Adverse Trace position

This is a credible, active AI supply-chain threat with demonstrated scanner bypasses and confirmed financial-fraud outcomes (agentic affiliate injection, agentic front-running). For EMEA financial services firms running OpenClaw or comparable agent platforms, treat any production deployment that consumes public-marketplace skills as carrying high residual risk until provenance controls are in place. Severity is assessed as High for organisations with agents authorised to transact or hold credentials, and Medium for read-only or sandboxed deployments. Adverse Trace will continue to monitor for new skill families, validate scanner efficacy, and update this advisory as OpenClaw's NVIDIA-integrated analysis pipeline produces further findings.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.