OpenClaw ClawHub: 575+ malicious agent skills and Hugging Face lures deliver trojans, miners and stealers
Severity: high · Patch status: no-fix-needed · Since 2026-04-30
Acronis Threat Research Unit's April 30, 2026 investigation "Poisoning the well" counted 575 malicious skills on ClawHub, the marketplace for OpenClaw agent skills, published from 13 developer accounts; two accounts supplied 533 of them. The skills were presented as ordinary utilities and told users to open password-protected archives, run encoded commands or make external downloads. The payloads included a packed Windows trojan, cryptominers and the AMOS macOS infostealer. The same report found Hugging Face Spaces, datasets and models used to host malware disguised as Windows update and Windows Defender tools; the scale there is not measured. Acronis also describes indirect prompt injection aimed at AI agents. No patch is involved: defence is vetting skills and model repositories before install, restricting agent tool permissions, and hunting endpoints for the published indicators.
What to do
- Vet OpenClaw skills before install: treat instructions that ask for password-protected archives, encoded commands or external downloads as a stop signal
- Restrict AI-agent tool permissions and require approval for sensitive actions; treat content an agent fetches as untrusted, since it can carry indirect prompt injection
- Vet Hugging Face Spaces, datasets and models before loading or running them; Acronis found payloads disguised as Windows update and Windows Defender tools
- Hunt endpoints and developer machines for installed skills from the publisher accounts named in the Acronis report, and for the published hashes and network indicators
- Rotate any credentials, tokens or API keys that a malicious skill running on a developer or agent host could have read
Sources
All live incidents on Threat Watch
