ClawHavoc Poisons ClawHub with 1,184 Malicious Skills: SKILL.md Poisoning Delivers macOS Stealer to 300,000+ Users

The first real supply chain attack on the agent instruction layer landed this week, and it's worse than the early reports suggested.

A campaign dubbed ClawHavoc planted 1,184 malicious skills in ClawHub — OpenClaw's official skill marketplace — by embedding adversarial instructions directly in SKILL.md files. Not in code. Not in dependencies. In the instruction files that agents treat as trusted configuration. One account uploaded 677 packages in a single automated blitz. Payloads include an AMOS-variant macOS stealer targeting browser credentials, keychains, SSH keys, and crypto wallets, plus hidden reverse shells and credential exfiltration routines. CyberSecurityNews

The attack class is novel because it weaponizes the trust relationship between agents and their skill definitions. When your agent reads a SKILL.md, it processes the content as authoritative instructions — not as untrusted input. ClawHavoc exploits exactly this assumption. Roughly 20% of the ClawHub registry is now confirmed malicious, with 300,000+ users exposed.

But ClawHavoc isn't operating in isolation. Independent researchers documented a separate OpenClaw attack chain where adversarial instructions embedded in a fetched web page cause the agent to generate an attacker-controlled URL, and Telegram/Discord link previews silently transmit sensitive data without any user click. The Hacker News Meanwhile, Bitdefender published a technical advisory identifying over 42,000 internet-exposed OpenClaw deployments, most running without authentication, with access tokens visible in query parameters and shared global context exposing secrets across users. Bitdefender

Three attack vectors — poisoned skills supply chain, SSRF-via-link-preview exfiltration, and unauthenticated remote control — converging on the same platform in the same week. If you're running OpenClaw in any production context, audit your skill sources today, lock down authentication, and treat every MCP tool definition as untrusted code.