How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware

While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation pointers. Both links led to malicious infrastructure.

The flow was classic staged delivery: The skill’s overview told you to install a prerequisite. The link led to a staging page designed to get the agent to run a command. That command decoded an obfuscated payload and executed it. The payload fetched a second-stage script. The script downloaded and ran a binary, including removing macOS quarantine attributes to ensure macOS’s built-in anti-malware system, Gatekeeper, doesn’t scan it.

I’m intentionally not pasting the exact commands or URLs here. The mechanics are unfortunately straightforward, and repeating them helps attackers more than it helps defenders. The key point is that this was not “a suspicious link. ” This was a complete execution chain disguised as setup instructions.