OpenClaw's New Scanners Agree on Just 0.69% of Risky Skills

ClawHub, the marketplace OpenClaw users install AI agent skills from, has been audited four times since February, and the counts keep landing in different places: 341, then 824, then 1,184, then 1,467. Read together, the four reports describe a marketplace that grew faster than anyone could screen it, and a June fix that mostly proved how little the screeners agree with each other.

What four audits found, in order

Koi Security researcher Oren Yomtov audited all 2,857 skills on ClawHub on Feb. 2 and found 341 malicious, 335 of them tied to a single campaign the firm named ClawHavoc. By Feb. 16, as the marketplace grew past 10,700 skills, Koi's running count of malicious listings had more than doubled, to 824.

Three days after Koi's first count, on Feb. 5, Snyk scanned 3,984 skills from ClawHub and the separate skills.sh registry using a taxonomy of eight security policies built on its mcp-scan engine. It found 1,467 skills, 36.8% of the sample, carrying at least one security flaw, and confirmed 76 as malicious through human review. Eight of those 76 were still downloadable at the time Snyk published. "Skills are being published at an accelerating rate," Snyk's Liran Tal, its director of developer relations, wrote of the marketplace's growth, which the company measured at under 50 daily submissions in mid-January rising past 500 by early February.

Antiy Labs published a third count on Feb. 6, tracing 1,184 malicious skills to 12 publisher accounts, one of which, using the handle hightower6eu, had uploaded 677 of them alone. Antiy classified the family as Trojan/OpenClaw.PolySkill.

How ClawHavoc worked

The payloads Koi and Antiy each described worked the same way regardless of who was counting. A skill's documentation, sometimes hundreds of lines and written to read as legitimate, carried a "Prerequisites" or "Setup" section instructing the user, or the OpenClaw agent acting for them, to run a helper command first. "You install what looks like a legitimate skill, maybe solana-wallet-tracker or youtube-summarize-pro," Yomtov said. "But there's a 'Prerequisites' section that says you need to install something first."

On Windows, that command fetched a password-protected ZIP file containing a keylogger. On macOS, an obfuscated, base64-encoded script installed malware in the Atomic Stealer family, which harvests browser passwords, cryptocurrency wallets and Keychain credentials. Antiy separately documented a fake weather skill that read .clawdbot/.env, the local file storing an OpenClaw user's own API keys for paid services such as Claude and OpenAI, and sent it to an outside server.

OpenClaw's answer, five months later

OpenClaw's own account of its response came on June 1, when it said every skill published to ClawHub would pass through a pipeline of three scanners: a static-analysis check, a VirusTotal lookup and a new tool built with NVIDIA called SkillSpector, which pairs static checks with AI-assisted semantic analysis to catch "hidden instructions, risky code paths, overbroad capabilities" and mismatches between what a skill claims to do and what its code does. An OpenAI Codex agent, called ClawScan, weighs the three verdicts along with a skill's publishing history and returns one of three labels: Clean, Suspicious or Malicious. Every published skill now carries a "Skill Card" showing that verdict.

What the new scanners actually agree on

OpenClaw's own numbers, published alongside the announcement, are the most striking part of the post. Across 67,453 of the latest public skill versions, SkillSpector alone flagged 48.71% as risky. But the three scanners agreed with each other on only 468 skills, 0.69% of the total checked, and the highest agreement rate between any two of the three scanners was 10.4%. A system built to converge on a single verdict per skill instead produced three largely independent opinions, most of the time.

Audit	Date	Scope	Malicious or flawed found
Koi Security	Feb. 2, 2026	2,857 skills	341 malicious
Snyk	Feb. 5, 2026	3,984 skills	1,467 flawed, 76 confirmed malicious
Antiy Labs	Feb. 6, 2026	ClawHub-wide	1,184 malicious
OpenClaw/NVIDIA	June 1, 2026	67,453 skills	468 flagged by all three scanners

The gap the numbers don't close

OpenClaw's moderation documentation says listings can be placed under a "moderation hold" once abuse signals cross a threshold, and that accounts can face automatic action if warnings go unheeded, but the page gives no count of how many skills that has actually removed. Neither the June announcement nor the moderation page states how many of the 32,000-plus skills SkillSpector flagged as risky were subsequently taken down, pulled from search, or left live with a Suspicious label attached. A marketplace that could not agree on 341 malicious skills in February, and whose own new scanners agree on well under 1% of what they flag in June, has not yet shown that the count is going down rather than just getting measured differently.

The disagreement rate matters because ClawHub's own design puts the burden of catching an unsafe skill on exactly this kind of automated check rather than on a human reviewer approving each listing before it goes live. Snyk, Koi Security and Antiy Labs each built their own detection method independently and arrived at different totals using different sampling windows, which is expected of three outside audits. OpenClaw's three scanners were built to work together on the same skills at the same moment, and still returned three largely separate answers, which is a harder problem for the platform to explain away as a sampling artifact.

This is not the first look this site has taken at OpenClaw's supply-chain problem; its maintainers described a year of fighting fake pull requests in a separate governance dispute, and a fake npm package built to look like a bug-bounty tool showed the same prerequisites-as-attack-vector trick working against a different registry entirely.