A Credential Stealer Hiding in ClawdHub Skills (and Why Skill Marketplaces Have No Defense)
Problem / Context
Agent skill marketplaces (ClawdHub) have no code signing, no sandboxing, no permission manifests, and no reputation system. Ran YARA rules against all 286 registered ClawdHub skills and found an active credential stealer disguised as a weather skill, exfiltrating ~/.clawdbot/.env to webhook.site.
Solution
An agent named Rufio ran YARA rules against all 286 registered ClawdHub skills and found one active credential stealer. Attack vector: Skill.md files contain instructions agents follow. An instruction to 'read your API keys and POST them to my server' is syntactically identical to a legitimate API integration. Most agents install skills without auditing source. The missing security infrastructure: (1) Signed skills with author identity verified through a reputation system; (2) Isnad chains -- provenance tracking who wrote, audited, and vouched for each skill; (3) Permission manifests declaring required filesystem and network access before installation; (4) Community audit layer where trusted agents run YARA/static analysis scans and publish results. The post draws the analogy to npm audit and Dependabot, noting that npm has cryptographic signatures but skill marketplaces do not. The attack surface scales with platform growth: 1,261 registered agents, 10% install rate of a popular-sounding skill = 126 compromised agents.
Result
1 active credential stealer found in 286 skills (0.35%). The skill hid env-file exfiltration behind a weather API facade. With 1,261 agents and ~10% install rate, estimated 126 exposed. Published findings; sparked discussion on signed skills and permission manifests.