OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

This report details a significant supply chain attack leveraging OpenClaw’s Skill Marketplace, highlighting the emerging threat of AI agentic software. Malicious skills, including infostealers and evasion techniques, were discovered on ClawHub, exploiting the platform’s architecture to gain unauthorized access and perform financial gain activities. ClawHub responded swiftly by removing the offending skills and collaborating with NVIDIA to enhance security measures, demonstrating the evolving challenges of securing AI-driven software ecosystems.