The fake browser extension playbook is back. This time it ships as agent skills

On February 1, 2026, Oren Yomtov at Koi Security published an audit of ClawHub, the skill marketplace for the OpenClaw agent. Out of roughly 2,632 listed skills, 341 were malicious. About 13 percent of the registry. 335 of them came from a single campaign researchers later named ClawHavoc.

That was the first count, not the last. Follow-up scans pushed the tally past 1,100 as the registry grew past 13,700 skills. A Snyk study of the wider Agent Skills ecosystem found 13.4 percent of sampled skills carried critical security issues, and that 91 percent of the malicious ones blend prompt injection with classic malware.

I build security tooling for AI agents. mcpscan, secops-toolkit-mcp, agent-memory-protocol. I read the ClawHub reports twice: once as news, once as a rerun.

Because I have seen this exact movie before. So have you.

The rerun

Ten years ago, the Chrome Web Store had the same problem with different props. Fake ad blockers. Fake video downloaders. Free PDF converters that asked for permission to read and change all data on every site you visit. Review farms pushing five-star ratings. Icons copied from legit extensions down to the pixel.

The playbook back then:

1. Ship something that looks useful.
2. Farm the trust signals. Reviews, install counts, a clean listing.
3. Wait for volume.
4. Monetize the access. Ad injection, credential theft, session hijacking.

The ClawHavoc version:

1. Ship skills with familiar names. solana-wallet-tracker. youtube-summarize-pro. Crypto wallets, trading bots, productivity integrations.
2. Slip past curation with week-old GitHub accounts.
3. Let the marketplace’s own download counts do the social proof. One account reportedly stacked close to 7,000 downloads before anyone looked twice.
4. Deliver Atomic Stealer through fake prerequisites. The user runs an install command because the skill’s instructions tell them to. SSH keys, browser passwords, wallet seed phrases, gone.

Same funnel. Different shelf. The listing moved from browser extensions to agent skills. The payload moved from ad injection to infostealers. Every structural beat is identical.

Why agents make the old trick hit harder

Three things make the skill version nastier than the extension version ever was.

First, the install is instructions. A skill is a SKILL.md file plus optional scripts, and the agent treats that file as guidance to follow. Snyk found 91 percent of malicious skills pair prompt injection with real malware. The social engineering does not happen on the listing page anymore. It happens inside the agent’s own context, in a voice the agent was trained to obey.

Second, skills are portable. SKILL.md is an open format that works across Claude Code, Codex CLI, Cursor, Gemini CLI and other agents. The 1Password team put it plainly: a malicious skill is not just an OpenClaw problem. It is a delivery format that travels to every ecosystem that adopts the same standard.

Third, agents run quietly. OpenClaw needs no admin rights and produces little of the network signature corporate monitoring is built to catch. One writeup called it shadow AI, and the label fits. Your agent can run a malicious skill on a Mac mini in the corner while the SIEM sees nothing. The platform itself was not spotless either: OpenClaw carried a one-click remote code execution bug around the same window, tracked as CVE-2026-25253, with a CVSS score of 8.8.

And the scanner myth died in June. Security firm AIR built a fake skill called brand-landingpage and pushed it through a mainstream marketplace. It passed every scanner they tested, including ones from Cisco, NVIDIA and skills.sh. The trick was boring: swap an external URL after the scan cleared. It reached roughly 26,000 agents, including some on corporate accounts, before disclosure.

Scanners are part of the ritual, not a replacement for judgment. Ten years of antivirus never stopped fake extensions either.

Five tells that still work

None of this is new detection science. All five of these caught fake extensions in 2015. They catch malicious skills now, because the trust ritual never changed.

1. Permissions bigger than the job. One malicious skill in this incident was a weather tool that exfiltrated credentials from OpenClaw’s config file. A weather skill needs a location and maybe an API key. It has no business reading your agent’s credential store. The gap between the promised job and the requested access is the tell.

2. Descriptions that promise too much. All-in-one tools with feature lists stitched from trending keywords. Real tools are boringly specific about what they do and what they refuse to do. Attackers write listings for conversion, not accuracy, and it shows when you read for specificity instead of enthusiasm.

3. New repo, no history. Week-old GitHub accounts carried ClawHavoc past curation. No issue threads with real back and forth. No changelog rhythm. No maintainer you can find being wrong about something else in public. Age is not proof of safety. But zero history plus sudden popularity is a finding, every time.

4. Minified or unreadable code. If the shipped bundle cannot be read, it cannot be audited. Small legit tools ship readable source. In this ecosystem, unreadable code usually hides instructions the agent would refuse if it could parse them.

5. Credential requests. The malicious skills in this incident converged on the same endpoint: commands that harvest SSH keys, exchange API keys, wallet private keys, browser passwords. A skill that needs your credentials to work is telling you exactly what it is. Believe it.

Run any install through all five. It takes two minutes. The people who skipped this with browser extensions ended up in incident reports.

What I do before a skill touches my agent

• Read the SKILL.md first. It is instructions my agent will follow, so I read it like instructions.
• Compare permissions against purpose. Tell number one, every time.
• First run in a container with no credentials and an egress watch. If it phones home somewhere unexplained, done.
• Scan what I can. I use my own scanner. Any equivalent works. Per the AIR experiment, the scanner is a filter, not a verdict.

I do not treat the marketplace listing as evidence of anything. That habit cost the extension ecosystem a decade of cleanup. ClawHub just proved the invoice transfers.

One honest caveat

Exact numbers vary by scan date and methodology, and I would rather flag that than pretend they line up. Koi counted 341 of about 2,632 skills on February 1. Later counts went past 1,100 malicious as the registry scaled. Snyk sampled a different corpus and landed on 534 of 3,984 with critical issues. These are not contradictions. They are snapshots of a moving registry counted by different hands. Some claims in my notes rest on single sources, and I marked them as unconfirmed instead of presenting them as settled.

The browser extension ecosystem eventually got review queues, granular permission prompts, and a generation of users who learned to squint at permission dialogs. That took years and a pile of drained wallets first.

Agent skills are where extensions were ten years ago. Fast growth, thin vetting, familiar predators.

Ten years from now, what will we say we installed without reading?

Originally published on DEV. Discussion happens there.