Malicious ClawHub Skills Use External Websites to Hide in Plain Sight

## Executive summary OpenSourceMalware identified a campaign where threat actors published ~40 trojanized ClawHub skills that contain benign-looking documentation but instruct users to install a malicious "OpenClawCLI" from external lookalike websites; this evasion technique moves payloads off the registry (bypassing VirusTotal scans) and uses base64-obfuscated install commands pointing to an IP-based C2 (91.92.242.30). The report lists affected skill names, URLs, and C2 indicators, documents takedown activity, and provides user and defender recommendations (hunt for the Vercel endpoint, block the C2 IP, verify official repositories).