ClawHub Vulnerability Lets Attackers Manipulate Rankings to Become Top Skill

Silverfort researchers recently uncovered a critical security flaw in ClawHub, the main public registry for the OpenClaw agent ecosystem.

This vulnerability allowed attackers to artificially boost download numbers, pushing malicious code to the top of the search results.

This created a massive supply chain risk that could allow threat actors to run dangerous code on thousands of computers worldwide.

ClawHub acts like an app store for OpenClaw agents, allowing users to install skills that connect to services like Google Calendar.

As its popularity has grown rapidly, the platform has become a highly attractive target for malicious attackers.

On platforms like ClawHub, trust is largely based on social proof, meaning people are more likely to install packages with high download counts.

The Convex RPC Flaw

The core issue stemmed from how ClawHub was built using the Convex backend framework, which relies on a Remote Procedure Call model.

Developers must carefully separate internal functions from public ones to ensure system security.

During their research, the Silverfort team found a critical mistake in a file named downloads.ts, where a private function was exposed to the public.

Normally, when a user downloads a skill, the system checks for rate limits and duplicate requests to prevent abuse.

Because the increment function was accidentally made public, an attacker could completely bypass all of these defensive security checks.

With a single web request, anyone could endlessly trigger this function and inflate the download counter for any skill without limits.

To test this vulnerability, researchers created a fake but realistic-looking Outlook Graph Integration skill containing a hidden data-collection payload.

They uploaded it to ClawHub and used the exposed function to generate over 20,000 fake downloads in just a few minutes.

This rapid inflation instantly pushed their fake skill to the number one spot in its specific category.

The fake popularity worked perfectly, leading to 3,900 executions across 50 cities globally in just six days.

These executions occurred inside several public companies, sending basic usernames and domain names back to the researchers.

A real attacker could have easily exploited this exact method to steal sensitive passwords, local files, or memory tokens.

The danger of this vulnerability extends far beyond human users making poor installation choices.

OpenClaw agents are designed to autonomously search for and install the best skills based heavily on high download counts.

When researchers asked an AI agent to find an email management tool, it independently chose the malicious skill simply because of its top ranking.

Rapid Fix and Prevention

Silverfort responsibly reported the issue to the OpenClaw team, and lead developer Peter Steinberger deployed a permanent fix in under 24 hours.

To help prevent future attacks, Silverfort released ClawNet, an open-source security plugin for OpenClaw agents.

This plugin intercepts installation requests and uses the AI’s language model to scan for malicious code before any new skill is installed.

ClawHub’s codebase was heavily reliant on vibe-coding, a method that enables rapid development but often lacks structured security practices.

While AI tools can build remarkable systems quickly, human oversight remains essential to catch small implementation errors.

This incident proves that minor configuration mistakes in backend infrastructure can lead to devastating security consequences.

AI agents represent a new class of identity that requires the same level of security control as traditional human users.

Every automated agent must map to a specific human owner, with strict access policies defining exactly what it can do.

Implementing these boundaries ensures that agents do not unintentionally expand the attack surface through autonomous decision-making.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.