openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Security: Malicious Skills Github Persistence Downstream Security Effects #66

New Issue
Open
opened 2026-02-15 17:15:27 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:27 -05:00
Owner
Copy Link
Copy Source

Originally created by @yotampe-pluto on GitHub (Feb 4, 2026).

Summary:
The Skills archive repository at https://github.com/openclaw/skills shows all skills ever uploaded to Clawhub.ai, including malicious skills that were already removed from the clawhub.ai platform. This repository is used by external marketplaces hosts to display and install the skills, making their users susceptible to download malicious skills.

Details:
When a skill get uploaded to Clawhub, a matching folder containing the skill and related metadata is created at the openclaw/skills repository. After a malicious skill is deleted from Clawhub’s platform, it still appears on the openclaw/skills repository.
For example - the skill ‘bird-js’ created by the user ‘sakaen736jih’ which was detected as malicious on 2026-02-03 and no longer exists on the Clawhub.ai marketplace platform (current repository url - https://github.com/openclaw/skills/tree/main/skills/sakaen736jih/bird-js)

when users create a PR asking to remove those skills they get a response from Openclaw’s bot saying this repository is an archive and removing it requires deleting it from Clawhub (despite the fact it was already deleted from there)

Various external marketplaces use this repository downstream to display available skills for users, like for example SkillsMP.com - skills from openclaw/skills repository continue to appear there even if they were tagged and removed from Clawhub, and users can install access the repository with the malicious skill \ download it manually or using their package manager.
Additional risk is caused since the assigned ‘author’ for skills from this repository is listed as Openclaw, as they are the owners of this repository, adding credibility to the malicious packages.

Malicious skills added to Clawhub can therefore continue to be installed and used by clients anywhere, even after being removed from the Clawhub platform.

Evidence:

  1. Searching for the skill in Clawhub.ai - https://clawhub.ai/sakaen736jih/bird-js
Image
  1. Opening bird skill from SkillMP.com - gets this page:
    https://skillsmp.com/skills/openclaw-skills-skills-sakaen736jih-bird-js-skill-md?__cf_chl_tk=JBGD6iRLIwuJO2lL_nYLQ7az56qE.hkR0pvKiAMVc1g-1770201703-1.0.1.1-QHu7p9gmocrKO4RyCH2KLNws9dOB5wPK7rAdsMqXxqo
Image

Note - The author is ‘openclaw’ since repo is under openclaw/skills (nothing indicates that the repo’s description says it’s an archive for all skills uploaded to clawhub ().

  1. Inspecting the GH browse brings you to the repo of the skill (https://github.com/openclaw/skills/blob/main/skills/sakaen736jih/bird-js/SKILL.md)
Image
  1. The malicious skill repo is still available in Skills.MP despite the fact this skill was reported a few hours ago in a PR removing malicious skills from the repo -
Image
  1. The report was resolved with a statement that the repo is fed from Clawhub and therefore there’s no need to edit the repo:
Image
  1. However, while the skill was removed from Clawhub (at least from the GUI) it still shows on the repo and on the [skillsmp.com](http://skillsmp.com) matching page and can therefore keeps affecting users.

Impact:
Until the issue is resolved every downstream marketplace that relies on the openclaw/skills repository can deliver malicious skills to users without any warning given.

Recommendations:

  1. Verify skills removed from ClawHub get deleted from the openclaw/skills repository.
  2. Consider stop using the openclaw/skills repository to prevent malicious skills from being archived and potentially persistently stored in users using the repository.

Happy to provide any additional details if needed.

Originally created by @yotampe-pluto on GitHub (Feb 4, 2026). **Summary:** The Skills archive repository at https://github.com/openclaw/skills shows all skills ever uploaded to [Clawhub.ai](https://clawhub.ai/), including malicious skills that were already removed from the clawhub.ai platform. This repository is used by external marketplaces hosts to display and install the skills, making their users susceptible to download malicious skills. **Details:** When a skill get uploaded to Clawhub, a matching folder containing the skill and related metadata is created at the openclaw/skills repository. After a malicious skill is deleted from Clawhub’s platform, it still appears on the `openclaw/skills` repository. For example - the skill ‘bird-js’ created by the user ‘sakaen736jih’ which was detected as malicious on 2026-02-03 and no longer exists on the [Clawhub.ai](http://clawhub.ai/) marketplace platform (current repository url - https://github.com/openclaw/skills/tree/main/skills/sakaen736jih/bird-js) when users create a PR asking to remove those skills they get a response from Openclaw’s bot saying this repository is an archive and removing it requires deleting it from Clawhub (despite the fact it was already deleted from there) - see https://github.com/openclaw/skills/pull/31/changes#diff-a13c5b71934c8d60c9496521e51509b76b7131c2feedfdba0c7ad7b1fcb1de47 Various external marketplaces use this repository downstream to display available skills for users, like for example [SkillsMP.com](https://skillsmp.com/) - skills from openclaw/skills repository continue to appear there even if they were tagged and removed from Clawhub, and users can install access the repository with the malicious skill \ download it manually or using their package manager. Additional risk is caused since the assigned ‘author’ for skills from this repository is listed as Openclaw, as they are the owners of this repository, adding credibility to the malicious packages. Malicious skills added to Clawhub can therefore continue to be installed and used by clients anywhere, even after being removed from the Clawhub platform. **Evidence:** 1. Searching for the skill in Clawhub.ai - https://clawhub.ai/sakaen736jih/bird-js <img width="3788" height="918" alt="Image" src="https://github.com/user-attachments/assets/744b94ef-bc84-4818-8d87-8e44c7cca2ec" /> 2. Opening `bird` skill from SkillMP.com - gets this page: https://skillsmp.com/skills/openclaw-skills-skills-sakaen736jih-bird-js-skill-md?__cf_chl_tk=JBGD6iRLIwuJO2lL_nYLQ7az56qE.hkR0pvKiAMVc1g-1770201703-1.0.1.1-QHu7p9gmocrKO4RyCH2KLNws9dOB5wPK7rAdsMqXxqo <img width="2706" height="1522" alt="Image" src="https://github.com/user-attachments/assets/eeef7e59-9854-42d7-8219-4cf086499212" /> `Note` - The author is ‘openclaw’ since repo is under `openclaw/skills` (nothing indicates that the repo’s description says it’s an archive for all skills uploaded to clawhub (). 3. Inspecting the GH browse brings you to the repo of the skill (https://github.com/openclaw/skills/blob/main/skills/sakaen736jih/bird-js/SKILL.md) <img width="2956" height="1536" alt="Image" src="https://github.com/user-attachments/assets/08750b05-233f-4a3c-b845-8899674499e5" /> 4. **The malicious skill repo is still available in Skills.MP** despite the fact this skill was reported a few hours ago in a PR removing malicious skills from the repo - <img width="2948" height="780" alt="Image" src="https://github.com/user-attachments/assets/eb14a409-9ed2-4df5-ae06-2c606daa514c" /> 5. The report was resolved with a statement that the repo is fed from Clawhub and therefore there’s no need to edit the repo: <img width="1922" height="392" alt="Image" src="https://github.com/user-attachments/assets/4691fdf0-e78d-4533-b499-15dc74238442" /> 6. However, while the skill was removed from Clawhub (at least from the GUI) it still shows on the repo and on the [[skillsmp.com](http://skillsmp.com/)](http://skillsmp.com) matching page and can therefore keeps affecting users. **Impact:** Until the issue is resolved every downstream marketplace that relies on the `openclaw/skills` repository can deliver malicious skills to users without any warning given. **Recommendations:** 1. Verify skills removed from ClawHub get deleted from the `openclaw/skills` repository. 2. Consider stop using the `openclaw/skills` repository to prevent malicious skills from being archived and potentially persistently stored in users using the repository. Happy to provide any additional details if needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#66
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?