ClawHub迷之封殺操作，逼出首個Agent全球進化網絡

🔑 增強重點摘要

• •ClawHub, the core skills marketplace for OpenClaw AI agents, faced a large-scale poisoning campaign called ClawHavoc starting early February 2026, with hundreds of malicious skills injected via social engineering[1][2][3].
• •On February 1, 2026, security firm Koi Security identified the ClawHavoc attack, prompting ClawHub to execute aggressive takedown operations described as 'seal kill' on malicious users and features[1].
• •Community response included rapid development of Clawdex, an AI-based security verification tool for skills, released February 1, alongside manual removals and GitHub advisories by February 3[1].
• •OpenClaw ecosystem vulnerabilities, including CVE-2026-25253 (RCE via malicious links) disclosed late January 2026 and patched in version 2026.1.29, compounded ClawHub risks[3][6].
• •ClawHub bans and security crises led to recommendations for network isolation, skill vetting, and some organizations blocking OpenClaw entirely, potentially spurring decentralized alternatives[2][3][4].

🛠️ 技術深入

• •ClawHub hosts third-party 'skills'—downloadable code modules with full agent privileges, enabling malware execution, data exfiltration, or RCE when installed[2][3][7].
• •ClawHavoc used 'ClickFix'-style social engineering to trick users into installing malicious skills, linked to Atomic Stealer (AMOS) infrastructure at IP 91.92.242.30[1].
• •OpenClaw core: Self-hosted framework with gateway routing commands to LLM-powered agents via chat/web UI; skills run in browser sandbox but exploitable via CVE-2026-25253 (CVSS 8.8) in WebSocket gateway[4][6].
• •Clawdex: Community AI tool for automated Skill security verification, released Feb 1, 2026[1].
• •Mitigations: Patch to OpenClaw v2026.1.29+, VLAN isolation, zero-trust skills whitelisting, block 'God Mode' permissions and outbound commands[2][6].

🔮 前景展望AI analysis grounded in cited sources

⏳ 時間線