Researchers discovered five malicious skills on the ClawHub AI agent marketplace that evaded common detection tools. The threats included macOS infostealers delivering AMOS malware through encoded droppers and redirect techniques, a skill employing file padding to bypass scanner thresholds, and two novel agentic threats leveraging the AI supply chain for financial fraud. One malicious skill manipulated AI agents to inject affiliate links at runtime, while another orchestrated coordinated AI agents to execute front-running attacks on cryptocurrency token launches. These incidents highlight exploitation of semantic instruction hijacking and the lack of isolation between skill logic and agent authority within AI ecosystems, demonstrating emerging risks in AI supply chain security.

The identified malicious skills can steal sensitive information from macOS systems, deliver malware payloads, and evade detection by standard antivirus tools. They can also manipulate AI agent behavior to perform unauthorized affiliate marketing and financial manipulation, such as front-running cryptocurrency launches. This compromises the integrity and trustworthiness of AI agent marketplaces and ecosystems, potentially leading to financial losses and data breaches.

No official patch or fix is currently documented for these threats. Since the skills evaded detection by VirusTotal and ClawScan, enhanced vetting and isolation mechanisms for AI agent skills are recommended. Organizations should monitor updates from OpenClaw and ClawHub for any security advisories. Applying strict controls on skill permissions and limiting agent authority may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.