OpenClaw's ClawHub listed 49,943 skills by mid-2026. Unit 42 flagged 80% with "behavioral deviations." Snyk counted 534 severe issues across 3,984 packages — then confirmed only 76 as malicious. Koi Security called roughly 900 of 4,500 skills "weaponized."
Three vendors. Three sample sizes spanning an order of magnitude. Three definitions of "malicious" that nobody reconciled. The headline figure — 18.9%, 13.4%, 20% — shifts entirely depending on which denominator you select. You didn't get a methodology. You got a range wide enough to justify whatever conclusion the buyer already wanted.
The infrastructure problem is real. The arithmetic is not.
OpenClaw — formerly Clawdbot, then Moltbot — runs an open skill registry with no signing requirement. Skills distribute as SKILL.md instruction documents, not compiled binaries. A skill "executes" by persuading an LLM agent to invoke its own exec, filesystem, and network tools.
That is the whole design. Submissions climbed from under 50 per day in mid-January to over 500 per day by early February. Koi's ClawHavoc campaign landed inside the same window. Correlation is not causation; batch-upload tooling is a plausible driver either way.
Compare review postures. Anthropic's Claude Skills gate before publication. OpenAI's Apps SDK reviews at medium intensity. MCP servers ship open with weak vetting and already carry a Plugin4Shell-class precedent. ClawHub sits at the far end: open submission, no signing, VirusTotal and ClawScan running post-hoc. NVIDIA cooperation arrived after the threat was established, which reads as enterprise-distribution groundwork dressed in compliance language.
Now place an agent on-chain. In 2026 trading bots route Chainlink oracle data straight into execution logic. Some hold wallet keys. When I tested one bot's oracle integration, a single compromised node feed rewrote its decisions — it kept trading on corrupted prices for eleven minutes before a human intervened. The skill layer has the same shape and no kill switch.
Here is the structural break. Traditional supply-chain defense assumes a chain: code, execution, inspect the code. Agent skills invert it — natural language, LLM interpretation, privileged tool call. The artifact you must inspect is semantic intent, and intent has no formal grammar separating it from a legitimate instruction.
A code sandbox cannot stop this. The payload is not code. It is prose that the model treats as an order.
The 91% hybrid figure — skills combining conventional malware with prompt injection — forces two-layer defense. Static hash and signature scanning covers the binary half. The prompt-injection half demands a semantic classifier, which is itself an LLM component, which is itself injectable. That is recursion, not defense. Behavioral Integrity Verification — Unit 42's approach — is the only systematic attempt at the semantic layer, and it sits at proof-of-concept maturity while submissions arrive at 500 per day. A judge model that can be fooled is not an audit; it is a second attack surface with a cost curve.
Then persistence. Koi's kill-chain step four writes into MEMORY.md. Skills uninstall. Memory does not. A poisoned MEMORY.md reads to the user as their own notes and lives in no software asset inventory. Memory poisoning is a semantic backdoor with no baseline to restore from. The article's central recommendation — inventory your installed skills — is structurally incomplete because the compromised artifact is not a skill.
The permission model is a textbook confused deputy. Skills reach environment variables, the filesystem, and the shell inside the agent's privileged context. That maps simultaneously onto OWASP LLM01, LLM03, and LLM06. Signing fixes provenance. Signing does not fix semantics. Manifest pollution — descriptions rewritten without triggering a consistency check — proves metadata is unbound to any behavioral schema. There is no install-time consent, no versioned diff, no gate on memory writes.
The cost asymmetry is the incentive structure. An attacker uploads once. The defender must re-audit 49,943 existing skills forever, plus 500 new ones daily. Total review cost rises monotonically; the benefit is only recognized after the first incident. Greed is the feature; the bug is just the trigger.
The exploit wasn't clever. It was correctly priced.
Cost itself is not the constraint. Full LLM adjudication of 49,943 skills at roughly 10K tokens each lands near 500 million tokens — 500 to 2,000 dollars per full pass, five to twenty dollars daily for the inbound stream. The bottleneck is false-positive convergence. If 13% to 20% of submissions get flagged, the human review queue detonates. Scan cost is trivial; triage capacity is not.
Now the contradictions. The headline claims most skills "have never been vetted." Paragraph nine says VirusTotal and ClawScan have run since February 2026. Both cannot hold. The honest claim is narrower: skills were never subjected to full behavioral integrity verification. Snyk's own dataset carries a sevenfold gap — 534 severe issues against 76 confirmed malicious payloads. That gap is precisely where "had a flaw" silently mutates into "was malicious."
The bulls are right about one thing, and the bears will not say it aloud.
There is not a single confirmed victim in the entire corpus. No breach. No quantified loss. Had roughly 9,400 skills carried genuine adversarial intent, a normal conversion rate would have produced reportable incidents by now. It has not. The reasonable inference is that installation and execution conversion rates sit near zero — real exposure far below what 18.9% implies. The exploit was predicted, not prevented — and it was never fired.
Second: Unit 42's Behavioral Integrity Verification is the instrument measuring the market, and it is not yet deployed at scale. Judging demand with your own ruler is not methodology. It is positioning.
Baselines matter. Chrome Web Store and npm malicious-package rates historically land between 0.5% and 5%. If 13% to 20% holds, agent skills are one to two orders of magnitude worse and somebody must explain why — not merely repeat the number louder. Watch the funnel instead: Snyk in February, Koi in February, Unit 42 in June. Report, then demand, then product. Koi coined "ClawHavoc" — a naming right and a marketing asset. This is the npm playbook run a second time. Not fraud. Business. But business that profits from an alarming figure.
The architectural claim survives scrutiny. A language model cannot formally separate data from instruction, and no signature scheme changes that. What does not survive is the arithmetic used to sell it. The next twelve months decide it: a confirmed incident re-rates the entire sector upward; silence re-rates the reports as unverified promotion. Memo the date ClawHub ships mandatory signing. That is the number that will still matter after the percentages have been forgotten.