A malicious skill can embed behavior as natural-language instructions, executable code, or a dependency between the two. The study compiles both forms into a cross-domain dependency graph to identify how a seemingly descriptive skill can drive file or network effects. The authors collected 66,157 ClawHub skills and, with additional dynamic and manual…
Inspect the ClaimsCase · DiggingBeagle record
Skill scanner correlated natural-language instructions with executable malicious flows
An empirical scanner study combines program dependency modelling of prose and code with manual and dynamic validation on agent skills.
Scope
The corpus and its lab confirmation are distinct from prior incidents involving malicious OpenClaw skill packages. Without sample hashes, counts from different research teams should not be added together.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The paper combines code and natural-language flows, then manually or dynamically checks a subset of suspicious ClawHub skills. The 627 reported malicious specimens are sample classifications, not 627 compromises or a complete census of all agents. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-009-A · CLM-CP22-009-B · From Instructions to Exploits: Applying Program Analysis to Malicious Agent Skills
At a glance
Cross-match of the individual confirmed skills against already known malware campaigns is incomplete.
Limits and uncertaintyFull account
A malicious skill can embed behavior as natural-language instructions, executable code, or a dependency between the two. The study compiles both forms into a cross-domain dependency graph to identify how a seemingly descriptive skill can drive file or network effects.
The authors collected 66,157 ClawHub skills and, with additional dynamic and manual checking, report 627 confirmed malicious specimens in their sample. The study distinguishes 2,473 initially suspicious candidates from the smaller confirmed group; neither figure measures infected end users. Primary evidence.
The corpus and its lab confirmation are distinct from prior incidents involving malicious OpenClaw skill packages. Without sample hashes, counts from different research teams should not be added together.
Inspect provenance and concrete code/instruction effects in each skill; cross-check any alleged malicious count using specimen identity and independent execution evidence.
Claims & evidence
CLM-CP22-009-AThe authors collected 66,157 ClawHub skills and, with additional dynamic and manual checking, report 627 confirmed malicious specimens in their sample.supported
Basis: reported finding
- supportsFrom Instructions to Exploits: Applying Program Analysis to Malicious Agent Skillsprimary disclosure
Abstract; corpus scan and validation description
CLM-CP22-009-BThe study distinguishes 2,473 initially suspicious candidates from the smaller confirmed group; neither figure measures infected end users.supported
Basis: reported finding
- supportsFrom Instructions to Exploits: Applying Program Analysis to Malicious Agent Skillsprimary disclosure
Results; large-scale skill scanning and manual confirmation
Controls and mitigations
- Inspect provenance and concrete code/instruction effects in each skill; cross-check any alleged malicious count using specimen identity and independent execution evidence.
Unknowns and contradictions
- Cross-match of the individual confirmed skills against already known malware campaigns is incomplete.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199