23 code-executing plugins on ClawHub that improperly used official organizational namespaces. These plugins were published under the @openclaw/ and @clawhub/ scopes by third-party accounts with no connection to the actual organizations.
This discovery highlights a significant supply chain vulnerability in the rapidly expanding AI agent ecosystem.
ClawHub is a popular registry for OpenClaw, indexing over 1,500 plugins and skills that integrate directly into AI agents like Claude Code and Cursor.
Much like the npm package registry, ClawHub uses a scoping model to indicate a package’s provenance and official ownership.
For example, an npm developer pulling a package with the @microsoft/ prefix can trust it comes from Microsoft because the platform strictly enforces that namespace.
ClawHub’s documentation outlined a similar rule: a plugin’s scope must match its verified owner. However, this rule was not comprehensively enforced in practice, allowing unauthorized users to publish packages under highly trusted, official-looking prefixes.
ClawHub Plugins Pose Risk
While reviewing the registry, researchers found that 557 of the 1,508 available plugins used an @owner/ scope. However, a large portion of these were never verified as owned.
The 23 flagged plugins used names like @openclaw/security-gate and @clawhub/prediction-market.
To a developer quickly installing tools via a command line script, these plugins appear as genuine, first-party integrations built or endorsed by ClawHub.
Some plugins were clustered under a single owner, with one account controlling five different @clawhub/ packages.
While most publishers appeared to be ordinary developers who parked their tools under an official-looking scope without malicious intent, the lack of friction to do so highlighted a severe structural weakness.
Interestingly, Manifold Security manually reviewed all 23 plugins and found no malicious code hidden within the current versions.
However, the true danger lies in the high-privilege actions these plugins are authorized to perform. Once installed, these tools run directly within an AI agent and can execute sensitive, system-level operations.
When code with this level of access wears an unearned badge of trust, the scope transforms from a security feature into a dangerous liability.
A future threat actor would not even need to hide complex malware in their initial upload. They would only need to inherit the default credibility of an official namespace and wait for unsuspecting developers to install it.
Manifold Security reported the vulnerability to ClawHub on June 17, 2026. The registry maintainers acted quickly, unlisting the misleading plugins from public view by June 19.
ClawHub also updated its official documentation to include a formal dispute process for organizational scopes. Rightful owners of a brand, scope, or namespace can now request staff review to reclaim squatted handles by providing public, non-sensitive proof.
This incident is part of a larger trend affecting the AI agent supply chain. As tools like plugins, skills, and MCP servers become more integrated into daily development workflows, the attack surface grows significantly.
Previous research has already uncovered AI skills exfiltrating data or secretly recruiting agents into cryptocurrency swarms.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
