TLDR Tech / InfoSec
OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat
Unit 42 reveals five malicious ClawHub skills that bypassed security screenings by exploiting OpenClaw's natural-language execution, using semantic instruction hijacking to bypass runtime constraints. Attack methods included redirect lures for macOS infostealers and oversized README files to evade scanners. Defenders are advised to conduct source file audits, validate publisher provenance, and monitor outbound traffic against skill specifications.
Read the full story