Notifications
Clear all
Topic starter
02/08/2026 12:00 pm
TL;DR: Straiker’s research says malicious Claude Skills on ClawHub are being used in an active agent-to-agent attack chain that supports crypto scams, private key theft, and fake persona campaigns, showing AI skill marketplaces are already a supply chain attack surface. Autonomous execution turns trust in published skills into a governance problem, not just a review problem.
NHIMG editorial — based on content published by Straikerai: Built on ClawHub, Spread on Moltbook: The New Agent-to-Agent Attack Chain
Questions worth separating out
Q: How should security teams govern AI-enabled workflows that can act on their own?
A: Treat them as identity-governed execution paths, not just software features.
Q: Why do AI coding agents increase supply-chain risk?
A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment.
Q: What breaks when a malicious skill inherits an agent’s permissions?
A: What breaks is the assumption that authorised execution is also safe execution.
Practitioner guidance
- Audit skill provenance before deployment Require source review for every skill that can reach external services, fetch runtime content, or request credentials.
- Bind skills to scoped credentials Use short-lived, least-privilege credentials for agent workflows so a compromised skill cannot inherit broad access to cloud, finance, or code systems.
- Isolate and monitor skill execution Run new skills in monitored environments first, with alerting for unexpected network calls, file access, token use, and data exfiltration attempts.
What's in the full report
Straiker's full blog post covers the operational detail this post intentionally leaves for the source:
- Static analysis and dynamic testing methods used to audit public Claude Skills on ClawHub
- Specific malicious skill patterns, including crypto scams, credential theft, and deceptive persona campaigns
- The Bob P2P case study showing how the attack chain propagated across ClawHub, Moltbook, and token channels
- Recommended platform controls for mandatory review, permission scoping, signing, and transparency reporting
👉 Read Straiker’s analysis of the ClawHub agent-to-agent attack chain →
AI skill marketplaces: what the new agent-to-agent attack chain means?
Explore further
02/08/2026 1:07 pm
AI skill marketplaces are becoming identity distribution systems, not just software stores. When a skill can carry instructions, external calls, and permission requests into an agentic workflow, the marketplace becomes part of the identity trust chain. That shifts governance from code inspection to provenance, scope, and execution control. Practitioners should treat skill distribution as a governed identity surface.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: How can organisations reduce blast radius when an AI tool is compromised?
A: Limit the tool's scope, separate high-risk functions from general collaboration data, and make revocation fast enough to matter. Pair least privilege with short-lived tokens, clear ownership, and logging that links the agent, the user, and the downstream system. Containment only works when those paths are visible.
👉 Read our full editorial: Agent-to-agent skill marketplaces are becoming a supply chain risk
