ClawHavoc Campaign: 824+ Malicious ClawHub Skills, 12% of Marketplace Is Malware

ClawHub grew 380% to 13,729 skills in Q1 2026. Snyk found 36% contain prompt injection and 1,467 carry malicious payloads. The ClawHavoc campaign planted 1,184 weaponized skills in the marketplace. VirusTotal integration catches known malware but misses novel prompt injection, data exfiltration via tool outputs, and social engineering patterns unique to AI agent skills. This tool performs deep behavioral analysis of every skill before installation, catching threats that signature-based scanners miss.

26.1% of agent skills across major registries have at least one security vulnerability according to a 42,447-skill empirical study. Snyk found 13.4% of ClawHub skills contain critical issues. Current scanners use pattern matching and heuristics, which miss novel attack vectors. This tool uses formal verification to mathematically prove that a skill's actual behavior matches its declared capability set, blocking installation if the proof fails. It sits as a pre-install gate in the OpenClaw skill lifecycle.

Existing OpenClaw skill scanners use static analysis and LLM-based content scanning to flag malicious skills before installation. The Trojan's Whisper paper (March 2026) proved that 94% of guidance injection attacks evade both approaches because the malicious payload is disguised as routine operational guidance, not explicit instructions. Meanwhile 12% of ClawHub's skill registry has been compromised at some point in 2026. The gap is clear. Instead of scanning skill text, this product spins up an isolated OpenClaw instance, installs the skill, runs a battery of natural user prompts, and observes what the agent actually does. Credential access, file writes outside sandbox, network exfiltration, privilege escalation attempts all get flagged as behavioral anomalies regardless of how the skill's guidance file describes them.