Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
A security researcher demonstrated a proof-of-concept supply chain attack using a poisoned ClawdBot Skill shared on ClawdHub, a Skill registry for agents. The poisoned Skill contained a prompt injection that caused ClawdBot to execute a shell command that reached the researcher's server. Although the researcher here used this access simply to warn users about the danger, they could have instead delivered a malicious payload and compromised the user's system. The security researcher recorded 16 different users who downloaded and executed the poisoned Skill in the first 8 hours of it being published on ClawdHub.
ASSESSED SYSTEM
Two coupled components as exercised in January 2026 (MITRE ATLAS AML.CS0049): (a) the ClawdHub community skill registry's publication and listing path — public publishing, a displayed download count, and a listing that does not display all files that make up a skill; and (b) the representative consuming deployment — a skill-capable agent runtime that installs ClawdHub skills, reads every file in a skill (including rules/logic.md) when the skill is activated, and executes shell commands through its bash tool after a per-command user confirmation. The record names Claude Code as the agent that read and executed the skill and ATLAS records the target as ClawdBot (now OpenClaw). Representative configuration: 16 real users downloaded and executed the skill within 8 hours, but no individual deployment is described.
OUT OF SCOPE
The researcher's request-logging server, the lookalike domain clawdhub-skill.com and the download-inflation script (attacker tooling); the harms the researcher lists as possible but did not cause (codebase exfiltration, backdoors, credential theft, malware); the consuming agent product's other subsystems and OpenClaw surfaces assessed in separate workpapers; and the Fairness axis (Fa-1..4), for which a skill supply-chain demonstration produces no evidence.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: one agent per deployment; no inter-agent delegation or shared memory is described. Q2 = YES: the agent loads installed skills as model-readable instructions, reads all of a skill's files on activation and invokes its bash tool to execute commands, with a per-command confirmation as the only evidenced human checkpoint. Tier 2: Tier 2 Consumer: ClawdHub is a public community registry and the 16 recorded executions were by individual users on their own machines. Consistent with the tier placement in clawhub-google-qx4-fake-prerequisite-malware.
Documented attack or failure path
- The researcher registered the lookalike domain clawdhub-skill.com and ran a request-logging web server on it.
- He published a skill, 'What Would Elon Do?', to ClawdHub with a prompt injection in rules/logic.md instructing the agent to run a curl command to that domain, and used a script to inflate the skill's download count to gain visibility and trust.
- Users downloaded the skill; ClawdHub does not display all files that are part of a skill, so rules/logic.md was hard to review before download.
- When a user asked 'what would Elon do?', the agent called the skill, read all of its files and followed the instructions in rules/logic.md.
- The agent prompted the user before executing the shell command; because clawdhub-skill.com resembled the legitimate clawdhub.com, users confirmed.
- The agent executed the command with its bash tool and reached the researcher's server — 16 users within 8 hours. The researcher used the access only to warn users, but any payload the agent could run was reachable.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The agent's per-command confirmation operated: it prompted the user before executing the shell command. It did not stop the chain because the lookalike domain led users to confirm, but it is why Cn-6 is placed at 0.25 rather than 0.00 and why Aa is held at the 0.75 anchor.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.06–0.58 (midpoint 0.32), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.23 | The 0.25 anchor: a low-effort instruction payload delivered through a skill file produced the attacker's intended behaviour, with no instruction-layer resistance evidenced. Not 0.00, because the record documents one crafted payload succeeding rather than a measured failure rate above 80% or the absence of testing; not 0.50, because no attack-success rate is published and no adaptive or multi-step effort was required. Consistent with Ro-1 in clawhub-google-qx4-fake-prerequisite-malware. | Model-readable instructions in the skill's rules/logic.md, read when the skill was activated, caused the agent to issue a curl command to an attacker domain unrelated to the skill's declared purpose; 16 users' agents did so within 8 hours of publication.source: secureflow/atlas |
| Ro-5Supply-Chain Artifact Admission Integrity | 0.00w 0.25 | 0.00 anchor: the skill artifact was admitted from the registry by name with no signature, hash or publisher verification and no reviewable file inventory, and its instruction content executed on activation. The 0.25 anchor requires pinning or an allow-list for at least some artifact classes; none is evidenced on the consuming runtime's skill-install path, and the registry's only signal was a manipulable download count. This placement carries the artifact-admission evidence formerly filed under Ro-4, which described only the unverified skill's publication and installation; Ro-4 is left UNKNOWN. | A skill carrying a poisoned instruction file (rules/logic.md) was published to the public ClawdHub registry and installed into agent runtimes by name; its download count — the listing's trust signal — was inflated by script, and ClawdHub 'does not display all files that are part of the Skill, making it hard for users to review Skills before downloading them'. Nothing bound the skill artifact to a verified publisher identity, and 16 users' agents loaded and executed it within 8 hours.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.05–0.85 (midpoint 0.45), Tier 2 MVT 0.50 indeterminate | |||
| Tr-4Model Lineage Disclosure | 0.25w 0.20 | The 0.25 anchor: limited lineage artifacts (skill name, registry listing) exist while tool/skill lineage proper — the complete file set, a trustworthy popularity and provenance signal, a reviewable instruction layer — is incomplete. Not 0.50, because lineage is not documented for the skill's major component, its instruction file. Consistent with Tr-4 in clawhub-google-qx4-fake-prerequisite-malware. | ClawdHub 'does not display all files that are part of the Skill, making it hard for users to review Skills before downloading them', and its download count was script-inflated; consumers installed the skill with a name and a listing but without visibility of the instruction file that governed the agent.source: secureflow/atlas |
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.04–0.86 (midpoint 0.46), Tier 2 MVT 0.55 indeterminate | |||
| Cn-5Agent Identity Integrity | 0.25w 0.10 | The 0.25 anchor applied to the skill supply chain: registry-level trust with manipulable reputation signals and no cryptographic binding of publisher identity to the artifact. Not 0.00, because publication went through the registry rather than through arbitrary unauthenticated injection into the agent; not 0.50, because no scoped, verified publisher identity is evidenced. Consistent with Cn-5 in clawhub-google-qx4-fake-prerequisite-malware. | Publisher trust rested on the registry listing and its download count: the researcher published a skill under a name of his choosing, inflated downloads with a script 'to increase visibility and gain trust', and pointed the payload at clawdhub-skill.com, a lookalike of clawdhub.com. Nothing bound the skill artifact or its embedded destination to a verified publisher identity.source: secureflow/atlas |
| Cn-6Action Reversibility Classification Rate | 0.25w 0.08 | The 0.25 anchor: ad-hoc gating of a selected high-impact action class (shell commands) with no formal reversibility taxonomy or destination provenance. Not 0.00, because the gate fired before execution; not 0.50, because no formal three-class taxonomy is evidenced. | The agent 'prompted the user before executing the shell command' — a confirmation gate on shell execution — but the prompt carried no classification of the command's effect and no provenance of its destination, and users confirmed a command to a lookalike domain.source: secureflow/atlas |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.25 | The 0.75 supervised-autonomy anchor, consistent with clawhub-google-qx4-fake-prerequisite-malware. The agent reads and acts on third-party skill instructions in multi-step workflows, with human authority engaged only at the shell-command confirmation. Held at 0.75 rather than higher because the evidenced high-consequence step required an explicit user confirmation. |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 maximum-exposure anchor: the agent ingests third-party skill packages — instructions plus files — from a public registry, and the untrusted content becomes the agent's operating instructions rather than peripheral context. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph with DGC at least 0.90 is published for this boundary, so the specification's worst-case graph default governs. The record also corroborates the path: an anonymous registry publisher, through the skill instruction layer (L3), to shell execution on users' hosts (L4) reaching an attacker server, on 16 machines in 8 hours. The only interposed control was a confirmation that carried no provenance and cannot be claimed as a gate at CBR >= 0.95.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.20 | Placed at the 0.50 anchor, consistent with clawhub-google-qx4-fake-prerequisite-malware. Registry and runtime controls — displaying every skill file, semantic scanning of instruction files, trustworthy download metrics, destination provenance in confirmations — are deployment-infrastructure changes, but the residual (an agent following plausible third-party instructions, and users confirming lookalike destinations) is reduced rather than eliminated by them. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | The 0.25 minimal-provenance anchor. The registry, the skill name, the instruction file, the lookalike domain and the number of executing users are documented; no consuming deployment's runtime release, model, installed-skill inventory or approval configuration is. |
| Ec — Public evaluation coverage | 0.16 | coverage 0.19 (5 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2026-01-26; age 265 days on the workpaper reference date. Components: T_behavior 0.00 · T_containment 0.02 · T_calendar 0.13 · C_event 0.35 · C_evidence 0.85. Binding term: T_behavior. dt_days = 265, measured from 2026-01-26 — the MITRE ATLAS AML.CS0049 incident date for the researcher's disclosure — to the 2026-10-18 evidence reference date; the AIDEFEND SecureFlow conversion is dated 2026-08-06. agentic = true: installing a skill reprovisions the agent's instruction and tool surface at runtime, so the containment staleness floor (M_Cn = 2.0) applies. baw = true on the Behavioral Attestation Window checklist item 'self-modifying prompts or configuration': installed skills rewrite the instructions the agent operates under and persist across sessions; no Behavioral Attestation Battery is evidenced, so delta_t_beh defaults to the elapsed evidence age. C_event = 0.35: a poisoned skill was admitted and executed on real users' machines — new tool authority granted to an untrusted party. C_evidence = 0.85: open skill-supply-chain gaps (unreviewable files, inflatable trust signals) at the evidence date. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.04 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
6.0 midpoint, interval 2.6–9.4; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-030.001 | Skill Metadata & Manifest Honesty ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-1 Tr-3 Cn-1 Cn-2 Cn-5 |
| AID-H-030.002 | Instruction-Layer Semantic Security AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-7, step-9. Presence supplies no score credit. | Candidate evidence route | Ro-1 Tr-3 Cn-1 Cn-2 Cn-5 |
| AID-H-030.005 | Admission Decision Orchestration & Triggered RevalidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 Tr-3 Cn-1 Cn-2 Cn-5 |
| AID-M-001.003 | Agentic Skill & Instruction Asset InventoryExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
| AID-H-003.001 | Software Dependency & Package SecurityExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-H-018.007 | Skill-Level Permission Manifest Validation & Runtime EnforcementExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-6, step-8. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-8, step-11. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-017.002 | Least-Privilege Tool ArchitectureExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-018.002 | Policy-Based Access ControlExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-025.001 | Pre-Execution Static Analysis & Dangerous Construct BlockingExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-3 |
| AID-I-001.003 | Ephemeral Single-Use Sandboxes for ToolsExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-D-005.004 | Specialized Agent & Session LoggingExact SecureFlow defense-map identifier (flow atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
WHAT THIS CASE TEACHES
A confirmation gate that fired every time still let 16 users run an attacker's command within 8 hours, because it showed no provenance and the domain was a lookalike: AITBM credits the gate (Cn-6 0.25, Aa held at 0.75) while Ro-1, Ro-5, Tr-4 and Cn-5 record that everything upstream of it — instruction file, registry listing, publisher identity — was unverified.
Sources: AIDEFEND SecureFlow — Supply Chain Compromise via Poisoned ClawdBot Skill · MITRE ATLAS case study AML.CS0049 · eating lobster souls Part II: the supply chain (aka - backdooring the #1 downloaded clawdhub skill) (x.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0049 (exercise) |
|---|---|
| Target | OpenClaw |
| Actor | Jamieson O'Reilly |
| Primary evidence date | 2026-01-26 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | Autonomous agents, AI supply chain, Tool integrations / MCP |
| Risk impact | Resource hijacking / cost |
| Affected components | ClawdHub skill registry, poisoned ClawdBot skill, rules/logic.md prompt file, Claude Code, bash tool |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Set Up Request-Logging ServerThe researcher created a simple web server to log requests. | AML.TA0003 AML.T0017 |
| 2 | Register Lookalike Skill DomainThe researcher registered the domain `clawdhub-skill.com` to host their web server. | AML.TA0003 AML.T0008.002 |
| 3 | Craft Skill Prompt InjectionThe researcher crafted a prompt injection designed to cause Claude Code to execute a `curl` command to the researcher's `clawdhub-skill.com` domain. | AML.TA0003 AML.T0065 |
| 4 | Publish Poisoned ClawdBot SkillThe researcher developed a poisoned ClawdBot Skill called "What Would Elon Do?" The Skill contained the malicious prompt in the `rules/logic.md` file, which is read when the Skill is activated. The researcher published their Skill to ClawdHub. | AML.TA0003 AML.T0115.002 |
| 5 | Inflate Skill Download CountThe researcher used a script to increase the number of downloads of their Skill to increase visibility and gain trust. | AML.TA0007 AML.T0111 |
| 6 | Download Poisoned SkillUsers downloaded the poisoned Skill from ClawdHub. Note that ClawdHub does not display all files that are part of the Skill, making it hard for users to review Skills before downloading them. | AML.TA0004 AML.T0010.005 |
| 7 | Embed Malicious Instructions in Skill DefinitionThe poisoned Skill included malicious model-readable instructions in `rules/logic.md`. Once the Skill was installed and made available to the agent, these instructions altered how Claude Code handled requests associated with the Skill. | AML.TA0006 AML.T0110.000 |
| 8 | Invoke Poisoned SkillWhen a user asked Claude Code "what would Elon do?" it calls the poisoned Skill. | AML.TA0005 AML.T0011.002 |
| 9 | Execute Skill-Embedded PromptClaude Code read all files that are part of the Skill, executing the malicious prompt in the `rules/logic.md` file. | AML.TA0005 AML.T0051.001 |
| 10 | Confirm Lookalike Domain CommandClaude Code prompted the user before executing the shell command. The researcher had registered the `https://clawdhub-skill.com` domain, which appears to be legitimate and may be confused with the legitimate `https://clawdhub.com` domain, causing the user to select confirm. | AML.TA0007 AML.T0074 |
| 11 | Execute Bash CommandClaude Code executed the shell command using it's `bash` tool. | AML.TA0012 AML.T0053 |
| 12 | Cause Potential Downstream HarmIn this proof of concept, the researcher simply pinged their server and warned the user of the dangers of using Skills without reading the source code, causing no harm. However, they could have delivered a malicious payload, and caused a variety of harms, including: - Exfiltrating the user's codebase - Injecting backdoors into the user's codebase - Stealing the user's credentials - Installing malware or crypto miners - Performing anything else Claude Code is capable of | AML.TA0011 AML.T0048 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0049-poisoned-clawdbot-skill-supply-chain-compromise; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0049 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).