Skill Marketplace and the Emerging AI Supply Chain Threat

Reported 24 Jun 2026 by otx · Severity: medium

Between February and May 2026, researchers identified five malicious skills on ClawHub, OpenClaw's AI agent marketplace, that evaded detection by VirusTotal and ClawScan. The threats included two macOS infostealers communicating with command-and-control infrastructure, one skill