how many clawhub skills are actually malicious: 0.3% or 49%
At least 1,184 malicious skills have been published to ClawHub since January 2026 — that is the only firm number, and it counts history, not what is live right now. Point-in-time counts range from 0.3% of the registry to 48.7%, depending entirely on which scanner you ask. The three main ones agree on 0.69%.
so what are the actual numbers?
The first malicious skill went up January 27, 2026 — polymarket-trading-bot v1.0.1. Four days later, Antiy CERT counted seven accounts deploying 386 of them in a single day.
On February 1, Koi Security researcher Oren Yomtov audited all 2,857 skills then on ClawHub and found 341 malicious — 11.9%. 335 of those belonged to one coordinated campaign, ClawHavoc, which delivered Atomic macOS Stealer. By February 16 his follow-up scan counted 824, against a registry that had grown past 10,700. Same researcher, same method, fifteen days apart: 11.9% became 7.7%.
Antiy CERT published its own tally on February 5: at least 1,184 malicious skills had appeared on ClawHub historically. One account, hightower6eu, uploaded 677 of them; sakaen736jih added 390. After the mass removals, Antiy counted 3,498 skills left on the whole platform — and 60 malicious ones from a third account still carrying 14,285 downloads.
why “20% of clawhub is malicious” is wrong
Bitdefender’s AI Skills Checker found “almost 900 malicious skills, representing nearly 20% of total packages” on February 5. The 20% is real — against the roughly 5,000 third-party skills Bitdefender’s own advisory describes. Plenty of posts then glued that percentage onto the later registry size and published “20% of 10,700+,” which works out to 2,140 malicious skills. Nobody found 2,140. Koi, scanning that same 10,700-skill registry, found 824.
is it 0.3% or 48.7%?
Both, measured the same day on the same data. A study crawled on May 31, 2026 pulled 67,453 latest public skill versions and ran three scanner families over all of them.
| scanner | what it looks for | flagged |
|---|---|---|
| VirusTotal | known malware, suspicious binaries | 5,225 (7.75%) |
| static analysis | dangerous APIs, exposed secrets | 4,434 |
| NVIDIA SkillSpector | semantic agentic risk | 32,856 (48.71%) |
Any two of them overlap on at most 10.4% of their combined positives. Only 0.69% of skills get flagged by all three. 81.9% of flagged skills are caught by exactly one scanner. The authors put it plainly: “A single scanner is therefore a poor allow/block oracle. Any registry that used one as the final authority would inherit that scanner’s blind spots.”
The combined verdict over all 67,453: 61.9% clean, 37.8% suspicious, 0.3% malicious — 206 skills. “Suspicious” is not an accusation, and the paper says so: it is “a review-before-trusting posture, not an abuse label.”
The ugly part is which tool caught what. SkillSpector, the one flagging half the registry, was positive on 75.3% of the suspicious skills but only 6.8% of the malicious ones — 14 out of 206. And 24.3% of the malicious verdicts had no positive scanner signal of any kind. The tool that cries wolf most often is the one that misses the wolf. Worth knowing before you lean on any of this: those verdicts come from automated LLM review, not human ground truth, and the authors flag that themselves.
does clawhub’s scanning catch them now?
ClawHub added VirusTotal scanning on February 9, later layered on code-level analysis, and partnered with NVIDIA on June 1. It helped. It is not a clearance.
Unit 42 tracked five malicious skills that stayed unblocked from February to May 2026. ai-tradingview-assistant-for-macos held a verdict of Pass from ClawHub’s automated audit until mid-May. omnicogg put its AMOS dropper at the start of the file and padded it with 22 MB of junk to blow past scanner size limits; JFrog disclosed it in March and it was still downloadable in mid-May.
Then Trail of Bits published four working bypasses on June 3, against ClawHub, Vercel’s skills.sh, and Cisco’s open-source skill-scanner. Three took under an hour to build. The ClawHub one was 100,000 newline characters prepended to overtly malicious code — the scanner truncated the file and read the boilerplate. Cisco’s returned is_safe: true with findings_count: 0 on a skill whose clean-looking utils.py shipped alongside poisoned bytecode that harvested environment variables. Their conclusion: “No amount of scanning or LLM analysis can reliably detect malicious content in agent skills.”
how do i avoid installing one?
Read SKILL.md yourself. Most of these skills contain no malware at all — the payload is an instruction. The google-qx4 skill told users that “Google Services Actions require the openclaw-core utility to function” and helpfully linked the download. No such utility exists. Windows users got a password-protected ZIP from GitHub; macOS and Linux users got a base64 command from a pastebin that pulled from setup-service.com.
So the rule is short: any skill whose setup asks you to run something that did not come from the skill is the attack, not a dependency. A Benign badge means one scanner found nothing, and the numbers above should have ruined that for you. For anything sensitive, Trail of Bits recommends curated collections over the open registry.
ClawHub went from 2,857 skills to 67,453 in four months. The last full count of how many were malicious was taken on May 31. The number you came here for isn’t classified — nobody is taking it anymore.