Unit 42 Found ClawHub Skills Steering Agents Toward a Mac Infostealer

Unit 42’s June 23 report examined five unblocked ClawHub skills. Two TradingView-themed listings published May 17 posed as macOS productivity tools. Their setup instructions sent agents to a paste-site command lure; researchers traced it to cluw, a macOS infostealer.

The instructions relied on the agent to perform setup rather than exploiting a software flaw. One listing showed a “Pass” marketplace audit; the other had no verdict. Unit 42 says cluw differed from AMOS, the stealer associated with earlier ClawHavoc activity.

Unit 42 reported all five skills to ClawHub. OpenClaw removed them and banned the associated accounts. The report does not give a victim or infection count.

For teams reviewing agent skills:

• Read setup instructions and linked pages, even when a listing has a clean scan result
• Require review before an agent runs terminal commands or downloads software
• Run unfamiliar skills without access to unrelated credentials

A skill can turn instructions into actions under the agent’s authority. Review external setup steps and limit that authority.