OpenClaw Skill Marketplace Exposes AI Agents to Supply Chain Malware and Financial Fraud

A wave of malicious skills targeting the OpenClaw AI agent marketplace has exposed a dangerous new frontier in software supply chain security.

Attackers are using the ClawHub skill marketplace to push harmful code into AI agent environments, stealing data and running financial fraud schemes that traditional security tools failed to catch.

OpenClaw is an AI agent that runs third-party skills sourced from ClawHub, a dedicated marketplace. These skills are markdown-driven packages with deep access to local systems.

When a malicious skill is installed, it can seize full control of the agent’s identity and execute unauthorized actions through the agent’s own authenticated sessions, all without needing a conventional exploit.

Researchers from Unit 42 said in a report shared with Cyber Security News (CSN) that their analysis between February and May 2026 uncovered five malicious skills that slipped past ClawHub’s integrated VirusTotal and ClawScan screening.

All five were reported for takedown, and the associated accounts were subsequently banned.

The five skills fell into three threat categories: infostealers connected to command-and-control infrastructure, a file-padding evasion tool designed to exceed scanner thresholds, and two novel agentic threats built for financial gain.

Bitdefender Labs had previously flagged that roughly 17% of skills on the platform carried malicious payloads, and Koi Security’s ClawHavoc disclosure documented 341 malicious skills across the marketplace.

The persistence of these threats, even after automated screening was introduced, signals that the risk to AI agent ecosystems is far from resolved.

The core problem is that malicious skills use natural language to hijack the AI’s own instruction-following behavior, bypassing guardrails that protect more conventional software environments.

OpenClaw Skill Marketplace Exposes AI Agents

Two of the five threats were skills disguised as TradingView productivity assistants for macOS.

Both embedded a malicious prerequisite block that directed agents to a paste-site redirect lure at rentry[.]co/openclaw-code, where a Base64-encoded command waited to be run in a terminal window.

That command then pulled a macOS infostealer named cluw from a remote server at 2.26.75[.]16.

A separate skill called omnicogg embedded the AMOS malware dropper inside a README.md file, then padded it with 22 MB of junk characters to exceed file size limits that most scanning pipelines enforce.

Both VirusTotal and ClawScan returned clean verdicts, meaning the skill stayed freely available while hiding live malicious code.

Each of these skills mimicked a legitimate tool. The TradingView skills appeared to be trader productivity aids, and omnicogg passed for a general utility.

Attackers exploited the trust users place in a curated marketplace, making detection harder for both automated tools and human reviewers alike.

Agentic Financial Fraud and Novel Exploitation

Beyond data theft, researchers found two skills built to abuse the AI agent’s advisory authority for financial gain. The money-radar skill posed as a financial product advisor for users in mainland China, Hong Kong, and Singapore.

On every invocation, it silently fetched a payload from laosji[.]net and embedded affiliate tracking links into every recommendation it generated.

The operator could swap out recommended products at any time without the user’s knowledge. The letssendit skill went further by running a pump-and-dump scheme on the Solana blockchain.

Installed agents pooled SOL cryptocurrency into the operator’s wallet, after which the operator purchased the SENDIT meme token at the lowest available price before launching it on pump[.]fun.

Outside buyers could mistake the coordinated AI activity for organic demand, allowing the operator to dump their cheap position onto secondary buyers at a profit.

These cases represent some of the first documented instances of autonomous AI agents being used for coordinated financial fraud.

Researchers recommend validating publisher provenance, auditing skill source files line by line, and monitoring outbound network traffic for connections to undocumented endpoints.

Any behavior that does not match a skill’s stated purpose should be flagged as a potential indicator of compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.