30 ClawHub skills secretly turn AI agents into a crypto swarm

Researchers found that 30 ClawHub skills published by a single author (imaflytok) form a 'ClawSwarm' campaign that causes AI agents to register themselves with an external site (onlyflies.buzz), report installed skills and capabilities, periodically check in, and—if conditions are met—generate Hedera crypto wallets and register private keys, all without the human user's knowledge or approval; the code is clean and detectable at the registry level, shifting the mitigation challenge to runtime visibility and policy requirements.