OpenClaw is an AI agent that runs third-party skills from ClawHub, a markdown marketplace with system-level access in the agentic software supply chain. After launch, malicious activity was found. ClawHub added VirusTotal and ClawScan, but from Feb–May 2026, five malicious skills still bypassed defenses.