Supply Chain Compromise via Poisoned ClawdBot Skill

Summary

A security researcher demonstrated a proof-of-concept supply chain attack using a poisoned ClawdBot Skill shared on ClawdHub, a Skill registry for agents. The poisoned Skill contained a prompt injection that caused ClawdBot to execute a shell command that reached the researcher's server. Although the researcher here used this access simply to warn users about the danger, they could have instead delivered a malicious payload and compromised the user's system. The security researcher recorded 16 different users who downloaded and executed the poisoned Skill in the first 8 hours of it being published on ClawdHub. Target: ClawdBot (now OpenClaw) Actor: Jamieson O'Reilly Procedure: 1. The researcher created a simple web server to log requests. 2. The researcher registered the domain `clawdhub-skill.com` to host their web server. 3. The researcher crafted a prompt injection designed to cause Claude Code to execute a `curl` command to the researcher's `clawdhub-skill.com` domain. 4. The researcher developed a poisoned ClawdBot Skill called "What Would Elon Do?" The Skill contained the malicious prompt in the `rules/logic.md` file, which is read when the Skill is activated. The researcher published their Skill to ClawdHub. 5. The researcher used a script to increase the number of downloads of their Skill to increase visibility and gain trust. 6. Users downloaded the poisoned Skill from ClawdHub. Note that ClawdHub does not display all files that are part of the Skill, making it hard for users to review Skills before downloading them. 7. When a user asked Claude Code "what would Elon do?" it calls the poisoned Skill. 8. Claude Code read all files that are part of the Skill, executing the malicious prompt in the `rules/logic.md` file.

Deployers

• ClawdBot (now OpenClaw)

Tags

• MITRE ATLAS
• AML.CS0049