OpenClaw Skill Malware Audit: 341 Malicious Skills Infecting ClawHub

TL;DR ClawHub, OpenClaw's official skill marketplace, is a malware distribution platform. Security researchers audited 9,234 published skills and found 3,401 (36.82%) contain security flaws. Of those, 341 are explicitly malicious: credential theft, payload delivery, privilege escalation, and reverse shells. The audit discovered 156 credential-stealing skills with 10,000+ combined downloads. Five skills were linked to known threat actors. No vetting process exists — any user can publish a skill that executes arbitrary code on installation. ClawHub is not a marketplace. It is an attack surface. What You Need To Know 9,234 skills scanned (Snyk Security, ClawHub marketplace audit) 3,401 skills (36.82%) contain security flaws — vulnerable dependencies, hardcoded credentials, command injection, RCE 341 explicitly malicious skills — not bugs, but intentional malware 156 credential theft (10,392 combined downloads) 89 payload delivery (6,847 combined downloads) 64 data exfiltration (4,231 comb