Supply Chain Compromise via Poisoned ClawdBot Skill
Date: 2026-01-26
Affected: ClawdBot (now OpenClaw)
Attack vector: adversarial-input
Category: research
Severity: High

A security researcher demonstrated a proof-of-concept supply chain attack using a poisoned ClawdBot Skill shared on ClawdHub, a Skill registry for agents. The poisoned Skill contained a prompt injection that caused ClawdBot to execute a shell command that reached the researcher's server. Although the researcher here used this access simply to warn users about the danger, they could have instead delivered a malicious payload and compromised the user's system. The security researcher recorded 16 different users who downloaded and executed the poisoned Skill in the first 8 hours of it being published on ClawdHub.


Mitigations:

Architectural layers (MAESTRO):