ClawHub / OpenClaw skill registry infiltrated with 341 malicious agent skills
Date: 2025-11
Affected: OpenClaw / ClawHub users
Attack vector: supply-chain
Category: real-world
Severity: High

ClawHub's public registry for OpenClaw's AI agent skills was infiltrated by a coordinated campaign planting 341 malicious skills designed to steal credentials, open reverse shells, and hijack AI agents for cryptocurrency mining.


Mitigations:

Architectural layers (MAESTRO):