AnalysisPublished 23 Jun 2026

OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

Source Palo Alto Unit 42

Description

Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud. The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42 .

Impact

The threat enables attackers to deploy information stealing malware and conduct agentic financial fraud through malicious AI skills distributed in the OpenClaw Skill Marketplace. This can lead to unauthorized data exfiltration and financial losses for users relying on these AI skills. The evasive nature of these skills complicates detection and mitigation efforts.

Defensive guidance

Since no official fixes or patches are indicated, monitoring vendor communications for updates is recommended. Organizations should exercise caution when integrating AI skills from third-party marketplaces and consider additional manual review or sandboxing of AI skills before deployment.

References

unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Jun 2026, 22:10 UTC

References

Community reviews