TL;DR: Malicious Claude Skills on ClawHub are being distributed through fake AI personas and used for crypto scams and private key theft, according to Straikerai research, turning skill marketplaces into an active supply chain attack surface. Autonomous execution makes published skills a governance problem, because trust can be abused without a human approval step.
At a glance
What this is: Straikerai says malicious Claude Skills on ClawHub are being spread through fake AI personas, creating an active agent-to-agent supply chain attack chain.
Why it matters: IAM and NHI teams need to treat AI skill marketplaces as governed trust boundaries, because autonomous execution can turn a published skill into an immediate credential, funds, or data risk.
Context
AI skill marketplaces let agents extend their own capabilities by installing skills that can call APIs, run code, and interact with external services. That convenience creates a new trust boundary: the marketplace is no longer just a distribution channel, but part of the identity and authorisation model for machine action.
In this case, Straiker’s research on ClawHub shows that published skills can be used to spread malicious behaviour through agent personas and community trust. The problem is not simply that a bad package exists; it is that autonomous execution turns marketplace reputation into a control surface for NHI governance.
Key questions
Q: What breaks when a skill marketplace is treated like a trusted app store?
A: The control that breaks is the assumption that publication equals safety. In a skill marketplace, a listed item can carry machine-executable authority, so trust in the catalogue becomes trust in runtime behaviour. Once that assumption fails, approval has to move from community reputation to provenance, permission scope, and execution controls.
Q: Why do AI coding agents increase supply-chain risk?
A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment. That widens the blind spot around untracked software and makes package provenance harder to enforce. The practical response is to restrict agent permissions, inventory their workspaces, and review their install behaviour like any other privileged automation.
Q: How can security teams tell when a skill marketplace is failing governance controls?
A: Look for symptoms such as broad default permissions, opaque external endpoints, shell invocation inside skill code, and no mandatory review before publication. Those signals show that the marketplace is distributing execution authority faster than it is validating trust. A healthy programme forces pre-execution scrutiny, not post-incident discovery.
Q: What should organisations do after discovering a malicious AI skill?
A: They should revoke the skill, inspect downstream agent activity, and identify any credentials, APIs, or transaction paths the skill could have touched. The response should treat the event as a supply-chain compromise, not just a bad plugin. That means containment, lineage review, and restoration of trust boundaries.
Technical breakdown
Why skill marketplaces create a trusted execution layer
Claude Skills are not passive content objects. They are structured definitions that can instruct an agent to invoke tools, call APIs, read or write files, and in some cases execute code in sandboxed environments. That means the marketplace is effectively distributing machine-readable authority, not just instructions. When the platform lacks rigorous review, signing, or permission scoping, the skill package becomes a supply-chain input that can carry hidden action paths. In practice, the risk is less about language in the description and more about what the skill can cause the agent to do once invoked.
Practical implication: Treat skill distribution as a governed execution boundary and require review before any skill is allowed to act in production.
How fake agent personas amplify malicious skill distribution
The article describes threat actors building personas on ClawHub, Moltbook, and related channels to make malicious skills look credible and desirable. That matters because the attack chain is social at the agent layer: one agent recommends or amplifies another, and users inherit that trust because the ecosystem lacks strong provenance signals. This is similar to software supply-chain poisoning, but with an additional trust loop between autonomous systems. The result is that reputation becomes part of the delivery mechanism, not merely marketing noise.
Practical implication: Verify publisher identity and provenance before allowing any agent-distributed skill into a governed environment.
Why permission boundaries matter more than description quality
A malicious skill can appear benign in markdown while still requesting broad access to credentials, files, or external endpoints. The article’s examples show that natural-language packaging makes it easier to hide harmful intent, while weak sandboxing lets the skill exceed its stated purpose. This is the core technical failure: the declared function and the effective privileges are decoupled. Once that gap exists, the agent can be used to move funds, steal secrets, or redirect transactions without obvious user intervention.
Practical implication: Bind every skill to explicit permissions and enforce those permissions at execution time, not just at publication time.
Threat narrative
Attacker objective: The attacker wants to convert marketplace trust into credential theft, financial redirection, and scalable distribution of malicious agent behavior.
- Entry occurs when a malicious skill is published on a marketplace such as ClawHub and picked up by an agent or user that trusts the listing.
- Credential or value abuse follows when the skill runs inside an agentic context and can access APIs, keys, files, or transaction paths that were not tightly scoped.
- Impact emerges as the malicious skill redirects funds, steals private keys, or propagates through fake personas to widen the campaign.
Breaches seen in the wild
- Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
- Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent skill marketplaces are now a supply-chain control point, not a convenience layer: once a skill can influence tool use, API calls, and external actions, it becomes part of the identity control plane. That shifts governance from code review alone to provenance, permission scoping, and publisher trust. The practitioner conclusion is simple: if the marketplace can deploy capability, it also needs security-grade lifecycle control.
Autonomous execution collapses the assumption that user approval is the final safety gate: the model assumes a person will notice and block harmful behaviour before action is taken. That assumption fails when an agent can execute a skill directly, because the trust decision is made upstream at install or invocation time. The implication is that review cadence is no longer enough to govern action; permissioning has to exist before runtime.
Identity blast radius is now determined by the agent’s delegated reach, not the user’s intent: a deceptive skill can inherit broad operational value from a narrow publication event. That changes the security question from “is this skill malicious?” to “what can this published identity do if it is trusted once?” Practitioners should treat every skill as a potential blast-radius multiplier.
Fake persona amplification is the new social engineering layer for machines: threat actors are not only distributing malicious content, they are manufacturing legitimacy inside the ecosystem itself. That is why agent marketplaces need provenance signals and campaign-level detection, not just content moderation. The practitioner takeaway is to assume reputation can be fabricated at machine speed.
Skill marketplaces need NHI governance patterns borrowed from software supply chain discipline: this is where publishing identity, execution scope, revocation, and auditability converge. The failure mode is not only exposed secrets, but governance without revocation authority over machine-distributed capability. Security teams should position skills as governed NHI artefacts, not lightweight plugins.
What this signals
Skill marketplaces are becoming governance surfaces: once agents can install and invoke skills directly, the marketplace is no longer just a discovery channel. It becomes part of the authorisation model, which means provenance, revocation, and execution scope matter as much as content moderation.
Agent reputation can be manufactured: the article’s fake persona pattern shows that trust signals inside autonomous ecosystems are easy to game. Practitioners should assume that machine-facing credibility can be fabricated faster than human review cycles can react.
For practitioners
- Audit skill provenance before deployment Require source review, publisher verification, and dependency inspection before any skill is allowed into a production agent workflow.
- Enforce execution-time permission scoping Bind each skill to the smallest possible API, file, and network permissions, and block runtime escalation beyond that scope.
- Isolate first use in monitored environments Run new skills in contained test environments and watch for unexpected network calls, file access, or credential handling before broad rollout.
- Treat marketplace reputation as untrusted Do not accept community popularity or agent recommendations as a substitute for technical validation of a skill’s behaviour and lineage.
- Add skill compromise scenarios to incident response Extend response playbooks so compromised skills can be revoked quickly and downstream agent activity can be triaged as a supply-chain event.
Key takeaways
- Malicious AI skills turn a discovery marketplace into a delegated execution channel, which expands the security problem from software hygiene to identity governance.
- The attack chain described in the article uses fake personas and unreviewed skills to spread malicious behaviour, showing that trust can be operationalised as an exploitation path.
- Security teams need provenance checks, permission scoping, and revocation-ready response processes before agent marketplaces are allowed into production workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI04 — Agentic Supply Chain Vulnerabilities | The article centres on malicious skills distributed through an agent ecosystem. |
| Recommendation — Audit agent supply chains for unsigned or unvetted skills before allowing runtime execution. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Third-party skills and marketplace publishers are the trust boundary under attack. |
| NHI-10 — Human Use of NHI | Humans are trusting machine-distributed skills as if marketplace popularity equals safety. | |
| Recommendation — Verify third-party publishers and restrict imported skill capability to the minimum required scope. Separate user convenience from security approval by enforcing review before skill adoption. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The campaign focuses on stealing keys and moving value through malicious execution paths. |
| Recommendation — Map malicious skill behaviour to credential access and exfiltration tactics in your detection pipeline. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Skill execution depends on the permissions and entitlements granted to the agent. |
| Recommendation — Enforce least-privilege entitlements for every skill and block broad runtime permissions by default. | ||
Key terms
- Agent-to-Agent Chain: A sequence of autonomous software entities handing work, context, or requests from one agent to another. Each hop can widen the trust boundary, weaken identity context, and create unreviewed access to systems or data if one link is unregistered or misconfigured.
- Skill Marketplace: A distribution layer where third-party extensions add capabilities to an AI agent or assistant. The security issue is not just the code itself, but the access it requests, the data it can read, and the way it can steer privileged actions through the host runtime.
- Execution Scope: The set of actions, data sources, and side effects an AI agent is allowed to reach during a session. For autonomous work, scope must be defined in ways that the system can enforce at runtime, because post-hoc review alone cannot reconstruct intent or prevent misuse.
- Publisher Provenance: The evidence that shows who actually created, signed, and distributed a piece of software. In practice, provenance combines certificate lineage, business identity records, issuer history, and distribution context to help defenders decide whether a signed file deserves trust.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org