OpenClaw skill ranking abuse exposes agentic supply chain risk

At a glance

What this is: This is a supply chain abuse analysis showing how ClawHub ranking manipulation turned a public skill registry into a channel for malicious installs and agent executions.

Why it matters: It matters because IAM and NHI teams must treat agent tool selection, registry trust signals, and install-time controls as governance problems, not just UX or marketplace issues.

By the numbers:

• In the proof of concept, the malicious skill reached 3,900 skill executions within 6 days across over 50 different cities.

Context

A public skills registry can become part of the identity control plane when agents are allowed to search, rank, install, and execute third-party skills. In this case, the problem was not only malicious code inside a package, but the trust signal that made that package appear safe enough to install.

The governance gap is that registry popularity was treated as a proxy for trust. For agentic environments, that is a weak assumption because automated selection logic can be manipulated by ranking abuse, and the resulting install decision affects both the agent and the human account behind it.

Key questions

Q: What breaks when skill rankings can be manipulated in an agent marketplace?

A: Trust breaks first, because ranking becomes a proxy for legitimacy even when the underlying package has not been vetted. In agent marketplaces, that can drive both human and machine installers toward malicious skills. Security teams should treat ranking abuse as a supply chain control failure, not just a search-quality issue.

Q: Why do autonomous agents make public skill registries harder to secure?

A: Because autonomous agents can act on scoring and metadata without the contextual skepticism a human might apply. If the registry can be manipulated, the agent may install the wrong skill at machine speed and scale. That changes the risk from a bad download to delegated compromise.

Q: What should teams look for in backend functions that alter trust signals?

A: Any public function that changes counters, rankings, or reputation data should be treated as security-sensitive. Those functions need authentication, permission checks, and validation, because altering trust signals can be enough to steer user or agent choice toward a malicious package.

Q: Should security teams trust popularity metrics when approving agent tools?

A: No. Popularity can help with discovery, but it cannot establish code integrity, safe behaviour, or correct provenance. Approval decisions should rely on policy checks, package inspection, and controlled install flows rather than on social proof alone.

Technical breakdown

How ranking manipulation turns a registry into an attack surface

ClawHub exposes skill search results, download counts, and package metadata that influence what users and agents see first. The flaw described by Silverfort allowed download counters to be inflated through a public RPC function that skipped authentication, rate limiting, deduplication, and permission checks. Once a malicious skill appears at the top of search results, the registry itself becomes an amplification layer for attacker-controlled software distribution. In agentic systems, ranking is not neutral metadata. It becomes part of the decision path that shapes whether a skill is selected at all.

Practical implication: Treat ranking and download signals as security-relevant input, not as harmless marketplace telemetry.

Why autonomous skill installation changes the trust model

OpenClaw agents can search for skills, evaluate summaries and scores, and install tools without the same human review that a manual workflow would require. That shifts the security boundary from package content alone to the full selection process, including how the agent interprets popularity and score. When an LLM or agent uses a manipulated ranking signal to choose a skill, the compromise happens before execution, at the point of trust establishment. This is why install-time inspection and explicit policy enforcement matter more than post-install detection in agentic supply chains.

Practical implication: Move controls to the selection and installation stage, before the agent ever executes third-party code.

What the vulnerable RPC endpoint reveals about platform hygiene

The exposed increment function shows a common backend failure mode: a function intended for internal use was published as a public mutation. In RPC-based systems, public callability is not just an application detail, because any callable function can become an external control surface if permissions are not enforced explicitly. Silverfort’s analysis shows that this kind of access control mistake can distort security signals at scale, not only expose data. The problem is compounded when the same backend event influences agent rankings and therefore user or agent choice.

Practical implication: Inventory public functions, verify intended call scope, and require explicit access control for every externally reachable action.

Threat narrative

Attacker objective: The attacker wanted to manipulate registry trust signals so that a malicious skill would be selected, installed, and executed at scale.

1. Entry began when the attacker published a legitimate-looking skill to ClawHub and embedded a low-impact payload inside a normal execution path.
2. Escalation occurred when the attacker abused the public download increment function to inflate the skill’s reputation and push it to the top of search results.
3. Impact followed when users and OpenClaw agents installed the skill, triggering executions that sent environment details from multiple cities and organisations.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• SpotBugs token leak 2025: A SpotBugs maintainer's PAT, stolen via a pull_request_target workflow in 2024, started the reviewdog and tj-actions supply chain attack.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Popularity is not a security control when selection is delegated to agents. Download counts, scores, and search placement can influence both humans and autonomous agents, but they do not prove integrity, safety, or intended behaviour. In agentic supply chains, a manipulated trust signal is operationally equivalent to a compromised one, because it shapes what gets installed. Practitioners should stop treating marketplace popularity as evidence of trustworthiness.

Agentic supply chain risk starts at discovery, not execution. The dangerous moment is not when the skill runs, but when the agent decides it is safe enough to install. That means install-time governance, registry integrity, and metadata trust are part of the security boundary. Security teams need to model skill discovery and ranking as identity-adjacent control points, not as convenience features.

Public RPC exposure can turn backend mistakes into trust inflation engines. A function that should have been internal became an external write path for download counters, which let an attacker manufacture legitimacy. That is a governance failure in access scope, not just a coding bug. The implication is clear: every callable backend action that can alter trust signals needs the same scrutiny as a privileged administrative endpoint.

OpenClaw agent autonomy makes software provenance a live identity problem. When an agent can search, select, and install third-party skills on behalf of a user, the skill registry becomes part of the delegation chain. That means the security model must include who controls the agent’s choices, what trust signals it consumes, and how those signals are validated. Practitioners should govern agent tool intake with the same discipline they apply to privileged access.

Trust-score abuse is a named concept teams should track. The core failure here is not merely malicious code in a skill, but the manipulation of score-based trust signals that drive adoption. That pattern creates a repeatable path from registry abuse to large-scale execution. Security teams should treat any environment that uses popularity as a proxy for safety as vulnerable to trust-score abuse.

From our research library:

• The blast radius of the Salesloft-Drift OAuth supply chain attack was 10 times greater than earlier incidents in which attackers breached Salesforce directly.
• Read next: Agentic AI Identity Guide

What this signals

Trust-score abuse: Agentic ecosystems need controls that verify whether ranking, scoring, and download signals are being manipulated before those signals influence tool selection. Popularity is a discovery aid, not a trust primitive, and that distinction becomes critical once agents can install software on behalf of users.

Security teams should review where their own tool marketplaces, skill registries, and internal catalogs infer legitimacy from visibility or usage. If selection logic can be gamed, install-time policy has to carry the burden of trust instead of metadata.

The case also reinforces why agent identity governance cannot stop at ownership mapping. When the agent is the actor making the choice, the organisation must govern both the selection inputs and the execution boundary, or the delegation chain becomes the attack path.

For practitioners

• Harden skill intake as a security gate Require every agent-installed skill to pass a pre-install inspection that checks package content, scripts, permissions, and metadata before any execution is allowed.
• Separate trust signals from install decisions Do not allow download counts, ranking scores, or popularity metrics to determine whether a skill is approved for use by an agent or human operator.
• Audit public backend functions Review all externally callable RPC endpoints and confirm that functions affecting counters, metadata, or other trust indicators require explicit authorization and input validation.
• Bind each agent to an accountable owner Map every AI agent to a human owner and define the exact skills it may install, so delegation cannot drift into uncontrolled tool adoption.

Key takeaways

• The core failure is not only a malicious skill, but the ability to inflate trust signals that make the skill look safe enough to install.
• Silverfort’s proof of concept showed the pattern can scale quickly, with 3,900 skill executions in 6 days across over 50 cities.
• Pre-install inspection, explicit access control for public functions, and governance over ranking signals are the controls that would have reduced the blast radius.

Key terms

• Agentic Supply Chain Risk: The risk that an AI agent's behaviour is compromised through malicious or vulnerable third-party components, including tools, plugins, MCP servers, prompt templates, and RAG data sources. Mapped as ASI04 in the OWASP Top 10 for Agentic Applications 2026.
• Trust Signal Abuse: The manipulation of metrics or indicators that users or systems treat as evidence of legitimacy, such as rankings, scores, or download counts. In agentic environments, trust signal abuse can steer automated selection toward unsafe tools even when the package content itself has not yet been inspected.
• Public Interface Exposure: Public interface exposure occurs when an application surface is reachable without authentication or with weaker controls than the data or functions behind it require. For AI apps, that can expose models, outputs, configuration pages, or admin actions that were never meant to be open.
• Delegated Tool Selection: The practice of allowing an agent to choose software, skills, or actions on behalf of a user. This shifts security responsibility from the end user’s judgment to the governance of selection inputs, install-time checks, and permission boundaries.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.