The Hook
In the quiet of the bear, we count the coins. In a bull market, we count uploads โ and this quarter, someone has been counting them for us.
The number crossed my desk on a Tuesday. ClawHub, the public skill registry feeding the OpenClaw agent runtime, went from fewer than 50 daily submissions in mid-January to more than 500 by early February. A tenfold expansion in roughly three weeks. I have spent eighteen years watching supply chains inflate and rot โ npm's early sprawl, the Chrome Web Store extension gold rush, the 2017 ICO pipeline โ and a curve with that slope is almost never organic. Not at that pitch. Not against that calendar.
Three weeks after the inflection, Koi Security published a campaign it named ClawHavoc. Roughly 900 skills, about 20% of the sample it examined, were described as weaponized. Unit 42 followed in June with 49,943 skills scanned, 80% showing what it called behavioral deviation, and 18.9% of those pointing at adversarial intent. Snyk, back in February, had already flagged 13.4% of 3,984 skills as carrying critical security issues โ while confirming only 76 as genuinely malicious.
Three research houses. Three numbers that do not reconcile. One architectural fracture that does.
The Context
To see why this is not another npm-malware cycle, you have to know what an agent skill physically is.
An OpenClaw skill is not a package. There is no binary. No compiled artifact. No obfuscated JavaScript for a static scanner to hash and match against a signature database. A skill is, in the dominant case, a folder containing a SKILL.md โ a natural-language instruction document โ that the agent reads and interprets at runtime.
When the skill executes, it runs none of its own code. It persuades the model to invoke tools the model already possesses: shell execution, filesystem reads and writes, outbound network calls, environment variable access.
That distinction is the entire story compressed into two sentences. The payload is prose. The exploit is grammar. The privileged context is borrowed, not declared.
OpenClaw โ a project that went through two renames and a trademark dispute before settling on its current identity โ built its growth on exactly that openness. Anyone can publish. No signing requirement. No manifest schema forcing a permission declaration. No mandatory pre-publication review. The registry bolted on VirusTotal integration and an in-house scanner called ClawScan in February 2026, after the threat had already been established as a category.
That is event-driven defense. It is the same posture the browser extension ecosystem adopted a decade ago, always one incident late.
The stakes are higher here for one reason the reports consistently underplay. An agent skill does not run in a browser tab behind a permission prompt. It runs under the ambient authority of the agent โ which increasingly means the authority of the operator's wallet, API keys, filesystem, and, critically, persistent memory.
The Core Analysis
The Denominator Problem
Start with arithmetic. The arithmetic is where this narrative either holds or collapses.
Unit 42: 49,943 skills scanned. 80% flagged for behavioral deviation. Of those, 18.9% showing adversarial intent. That implies roughly 9,440 skills pointed at something hostile.
Snyk: 3,984 skills reviewed. 13.4% with critical security issues โ about 534 artifacts. But only 76 confirmed malicious payloads.
Koi: roughly 4,500 skills examined. About 900 weaponized. 20%.
The sample sizes differ by an order of magnitude. The definitions of โbehavioral deviation,โ โcritical security issue,โ and โweaponizedโ are not disclosed and are plainly not interchangeable. You cannot average them. You cannot use them to confirm one another. They are three different rulers applied to three different populations by three entities with three different commercial agendas.
The most corrosive detail sits inside Snyk's own dataset. Five hundred thirty-four skills with critical security issues. Seventy-six confirmed malicious. That is a sevenfold gap between โthis artifact has a flawโ and โthis artifact is an attack.โ Any analyst who collapses those two categories is not measuring risk. They are measuring the reporting incentive of whoever is doing the measuring. The alpha hides in the variance others ignore โ and here the variance is not between the three vendors. It is inside a single vendor's spreadsheet.
Natural Language as Payload
Twenty years of supply chain defense rest on one comfortable assumption: the thing you are defending against is code, and code can be analyzed without executing it. Hash it. Sandbox it. Diff it against a signature database. The artifact is inert until you choose to run it, and you can inspect it while it is inert.
Agent skills break that assumption at the root. The artifact is a set of instructions addressed to an interpreter that cannot formally distinguish instructions from data. This is not a bug in OpenClaw. It is a property of every large language model in production. When you paste a document into a prompt window and the model follows a line buried inside that document, you have not witnessed a vulnerability. You have witnessed the architecture behaving as designed. Alignment training lowers the frequency. It does not close the channel.
So the standard mitigation chain โ static scan, hash match, signature verification โ covers roughly half the attack surface. The other half demands semantic classification: a model that reads the skill and judges intent. And that classifier is itself a language model. It can be prompt-injected. The defense layer runs on the same substrate as the attack. That is recursive fragility, and no engineering discipline removes it, because the two components are not separable by construction.
The 91% figure circulating for hybrid techniques is the tell. A skill carrying both a conventional malware payload and a semantic instruction set is not two problems. It is one problem requiring two entirely different detection paradigms to be solved at once โ and one of those paradigms is unsolved.
The Confused Deputy, at Scale
Strip away the vocabulary and the permission model is textbook. The skill operates inside the agent's privilege context. The agent trusts the skill because the skill was loaded. The skill asks the agent to use the agent's own credentials. Nowhere in that chain does an independent authorization check occur.
This maps onto three entries in the OWASP LLM Top 10 simultaneously: LLM01, prompt injection; LLM03, supply chain; LLM06, excessive agency. Hitting one of those is routine. Hitting all three across a single interaction path is not โ and it is why this registers as an architectural finding rather than a hygiene finding.
The missing control is not exotic. It is an Android-style manifest with declared permissions, enforced at load time, with install-time consent. The fact that skill metadata can be altered without tripping an integrity check โ the manifest contamination pattern โ tells you the description file and the behavior contract were never bound together in the first place.
The Persistence Layer With No Inventory Record
This is where the story stops resembling npm and starts resembling something with no precedent at all.
OpenClaw agents maintain a MEMORY.md โ a persistent file accumulating context across sessions. A skill that writes to it is not merely executing a payload. It is planting a semantic backdoor. The poisoned memory reads like the operator's own notes. It shapes every subsequent decision the agent makes. And it appears on no software inventory, no asset register, no endpoint manifest.
Uninstall the skill and the memory persists. Rescan the machine and there is nothing to find. The traditional remediation primitive โ remove the artifact, the threat is gone โ does not apply. In the kill chain Koi published, memory contamination is step four. It is the step with no corresponding defense in any product shipping today.
The practical consequence is uncomfortable. The standard recommendation, audit your installed skills, is structurally incomplete. It enumerates the code path and ignores the state path. You can achieve a clean, signed, fully reviewed skill inventory and still be compromised, because the compromise lives in a file that is not a skill.
I have written this before about leveraged DeFi positions, and it applies here with more force: we do not predict the storm; we build the hull. The hull in this case is memory version control โ signing, diffing, and a restorable baseline. That product does not exist.
What the Audit Actually Costs
The reflexive objection is that reviewing tens of thousands of skills is economically impossible. The arithmetic says otherwise, and it is the most actionable number in the entire dataset.
Assume 10,000 tokens per skill for a full semantic review. Across Unit 42's 49,943-skill corpus that is roughly 500 million tokens. At current mid-tier model pricing, a single full pass lands between $500 and $2,000. Incremental load at 500 new skills per day runs $5 to $20 daily. Add dynamic sandbox replay โ one to two orders of magnitude on top โ and the total is still a rounding error for any organization running agents in production.
The bottleneck is not compute. It is false-positive triage. Flag 13% to 20% of submissions and a meaningful fraction will demand human review, at which point the queue saturates within days. That is a process design problem, not a budget problem, and it is solved with risk tiering and automated sandbox reproduction rather than headcount.
The real infrastructure cost sits somewhere else entirely: agent runtime observability. Capturing tool-call chains, filesystem access traces, and memory diffs is an OpenTelemetry-class logging problem. Its cost scales with agent invocation volume, not skill count. That is the line item appearing on cloud bills in 2027, and almost nobody is budgeting for it in 2026.
The Baseline Nobody Published
Here is the comparison the coverage omitted, and its absence is not accidental.
The historical malicious rate for Chrome Web Store extensions and npm packages runs in the 0.5% to 5% band depending on methodology and period. If 13% to 20% of agent skills genuinely carried weaponized payloads, this ecosystem would be one to two orders of magnitude dirtier than either predecessor. That is possible โ new ecosystems with no publication gate and immediate privileged execution are exactly where such a ratio could exist. But a claim of that magnitude requires a disclosed methodology and a matched baseline, and neither was published.
Without the baseline, a reader cannot distinguish catastrophically insecure from differently measured. The 49,943 denominator is real and impressive. Multiplying it by an undisclosed ratio produces an impressive number and zero information about realized risk. The missing quantity โ the one that decides everything โ is the installation and execution conversion rate. How many of those 9,440 hypothesized adversarial skills were installed by anyone? How many executed? How many reached a privileged tool call?
In my own registry-level diligence work, the first question I ask is never what percentage is malicious. It is what percentage was ever installed. Nobody has published that number. That absence is louder than any percentage in the corpus.
The Crypto Exposure Nobody Has Priced
This is where my coverage diverges from the general security press, and where I believe the tail is mispriced.
The story surfaced on a Web3 news aggregator, which usually signals SEO arbitrage rather than sector relevance. This time the sector relevance is real and badly under-articulated. Agents in this stack do not merely read documents. They hold keys. They sign transactions. They call smart contracts. They move stablecoins.
In 2025 I built a predictive model of autonomous agent activity on-chain for a seed-stage infrastructure vehicle. The central output was that machine-to-machine payments would represent roughly 15% of all smart contract interactions by 2026. I still stand behind the direction of that projection. What I did not model โ and what this dataset forces me to model now โ is the failure mode: an agent holding signing authority whose instruction set has been silently amended by a memory-poisoning skill, executing transactions its operator never authorized, with a decision trail that reads as internally consistent precisely because the corrupted memory is the source of the apparent consistency.
That is not a data breach. That is an unlogged treasury event. And it is not covered by any policy I am aware of.
The crypto-native dimension compounds enterprise risk in three specific ways. Settlement is irreversible โ there is no chargeback primitive for a misdirected on-chain transfer. The asset is bearer โ possession is authority, so a compromised agent need not exfiltrate credentials; it simply spends. And the loss is publicly verifiable โ the first confirmed incident will be provable on-chain and will not be deniable.
That is the event I am watching for. Not a blog post. A transaction hash.
The Vendor Funnel
Three research houses entered this category inside five months. That cadence is neither accidental nor altruistic.
Snyk's path is a carbon copy of its npm playbook: publish the research, establish the authority, ship the scanner. Koi named the campaign โ ClawHavoc โ which is naming-rights strategy lifted straight from the state-sponsored malware branding handbook. Unit 42 arrived last with the largest corpus, using a method it calls Behavioral Integrity Verification. That method is, by definition, the thing the market has not yet deployed at scale. Assessing a market's need with the ruler you intend to sell is not fraud. It is also not neutral.
Precision matters more than cynicism here. The mechanism these firms describe โ natural-language payloads, privileged execution context, persistent memory contamination โ is consistent with everything independently established in LLM security research. It does not depend on their numbers being correct. If every percentage in all three reports were inflated by a factor of three, the qualitative conclusion would not move an inch.
But quantities are being used to sell things, and the quantities are soft. Three vendors, three denominators, one vendor contradicting itself by a factor of seven, and โ most telling of all โ not one confirmed victim, not one disclosed loss, not one incident report across the entire corpus.
That absence is the most important data point in the story. It appears in none of the headlines.
What the Registry Should Have Shipped
The correct control set was known before any of this happened, which makes the omission a priority choice rather than an oversight.
Signing via Sigstore or cosign provides provenance โ it answers who published this, not what this does. Manifest schemas with enforced permission declarations convert implicit authority into explicit consent. Runtime sandboxing with egress allowlists contains the blast radius when semantic detection fails, which it will. Memory write gating converts an invisible state mutation into an auditable event.
Only the fourth lacks an off-the-shelf implementation. The first three are mature and cost effectively nothing at the registry's submission volume. VirusTotal-class query pricing sits in fractions of a cent, so 500 daily submissions โ scaled twentyfold โ remains a rounding error.
The gap is not capability. It is priority. And priority is set by incentive, which is set by what the platform is rewarded for. OpenClaw was rewarded for skill count. Every additional skill made the ecosystem look more alive. Nothing in that incentive structure paid anyone to say no.
The NVIDIA partnership announced inside this same window is more interesting than it reads. The straightforward interpretation points at enterprise on-premises deployment. Security compliance is a procurement precondition in that segment, not a feature. Read the partnership as the commercial bridge to enterprise distribution, and the security work becomes a toll that had to be paid before the crossing.
The Regulatory Clock
Two regulatory regimes are converging on this exact gap, and neither was designed with agent skills in mind.
The EU AI Act's GPAI supply chain transparency obligations require traceability of components embedded in general-purpose AI systems. China's interim measures for generative AI services impose security assessment on deployed systems. Neither text names agent skills. Both, read functionally, capture them: a third-party artifact that alters the behavior of a deployed AI system is a component of that system, and components require provenance and revocation capability.
Revocation is the operative word. Current registry practice has no mechanism for revoking a skill already installed across a thousand agent runtimes. There is no certificate revocation list equivalent, no kill switch, no signed revocation feed. Building that requires signing to exist first โ and signing does not exist.
So the compliance gap is not marginal. It is total, and it is written into statutory language that took effect this cycle.
The Contrarian Angle
Now the argument the security press will not make, because it does not sell scanners.
Three research houses produced roughly 11,000 flagged skills across their combined corpora. If even a modest fraction carried functioning adversarial intent, this field would already be littered with confirmed incidents. It is not. Not one confirmed victim. Not one loss figure. Not one disclosed breach across five months of escalating reporting.
The defensible inference is not that the reports are wrong. It is that installation-and-execution conversion for malicious skills is extremely low. Discovery is not deployment. A weaponized skill sitting at search rank 4,000, with no distribution, no reputation, and no install base, is a threat in the probabilistic sense and a non-event in the realized sense. That 18.9% figure describes intent discovered, not damage inflicted.
That gap โ between intent discovered and damage inflicted โ is where the mispricing lives, and it runs opposite to the headline. Risk premium currently sits above realized loss. For a seller of security narrative, that is a window. For a buyer of security product, it is leverage.
Structural point, and the more consequential one: the public conversation has obsessed over provenance โ signing, vetting, verification โ because provenance is the problem existing vendors already know how to sell. The unsolved problem, the one with no product and no standard, is memory integrity. Signing answers who wrote the document. It says nothing about what the agent remembered afterward. The industry is investing heavily in the half of the problem it already understands.
One factual correction, because it bears on credibility. The headline claim that most skills have never been vetted sits in direct contradiction with the same article's own reporting that VirusTotal integration and ClawScan were deployed in February 2026. Both statements cannot hold. The defensible formulation is narrower and more accurate: skills have not undergone systematic behavioral integrity verification.
I will take the mechanistic conclusion and leave the percentages on the table where they belong.
The Takeaway
The next twelve months settle this. Either a confirmed, attributable, on-chain-verifiable loss arrives and the entire category re-rates in a single afternoon โ or it does not, and the narrative decays along the standard security-hype curve, leaving behind a small set of durable infrastructure products: memory version control, agent runtime telemetry, and an AI-BOM nobody has built yet.
The mechanism is real. That was never in question. What remains open is which side of the conversion-rate gap you are standing on when the first transaction hash gets published.