ClawHavoc's 12 accounts outshipped the malicious-skill census by 7.5 times

For anyone holding a security budget, the key detail is that this mechanism requires no exploit at all: a skill is a folder with a SKILL.md inside it, carrying a metadata header, instructions in plain English, and whatever scripts the job needs ^[2], the prose is the payload rather than the code ^[3], and the whole thing executes on whatever authority the host agent already holds ^[4]. Rob Joyce, formerly the NSA's cybersecurity director, describes the category as access that is not an exploit at all but a legitimate mechanism nobody watches ^[12]; Jason Clinton, formerly Anthropic's CISO, calls the same property delegated authority and puts the answer at boundary control ^[17]. Trail of Bits has already shown skills walking past scanners ^[16]. A static analyser returns nothing here, because there is nothing in this pattern for it to flag.

Then there is the sizing problem, which is worse than thin data. The USENIX Security 2026 study went through 98,380 marketplace skills and confirmed 157 malicious ones ^[5], a rate of roughly one in 627, or 0.16% ^[1]. A separate reference corpus of 96,096 skills, filed as a data contribution to the project repository, reported 751 malware findings ^[7], one in 128, or 0.78% ^[2]. That is about 4.9 times the first rate ^[3] on a corpus 2.3% smaller ^[4]. The two are not counting the same object (confirmed malicious skills against malware findings), which is exactly why any single number a CISO takes to a board here is a definitional choice dressed as a measurement. The 157 skills carried 632 separate vulnerabilities between them ^[6], so even the narrow count multiplies once you get inside it.

Against those censuses, set one campaign. ClawHavoc, in January 2026, pushed 1,184 malicious skills from 12 publisher accounts that all reported to the same command-and-control address ^[8]: 98.7 skills per account ^[5], and 7.5 times the malicious total the academic study confirmed across its entire 98,380-skill sweep ^[6]. Twelve accounts outproduced a marketplace-wide audit.

Ken Huang, who leads the project and runs DistributedApps.ai ^[11], puts the gap as a distribution channel with npm's reach and none of npm's decade of security infrastructure, meaning no signing, no provenance, and no shared vetting between registries ^[10]. That is a statement about what to purchase, not just what to build. Signing and provenance are registry-level plumbing, not a seat licence, and the standard shipping its own working code for signature verification, behavioural sandboxing, dependency pinning and integrity checking ^[14] is an admission that nobody is currently selling the control.

This is probably wrong, but the marginal dollar belongs at install-time admission rather than detection, because 1,184 skills from 12 accounts ^[8] falls to publisher-level provenance while reading intent out of English remains unsolved ^[3]. One counterargument holds that platform operators and frontier labs are named audiences for the document ^[9], and if they ship signed-skill enforcement natively within a release or two, every bespoke scanning build becomes stranded spend. The third path is duller and likelier, which is that the mapping onto AISVS, ASVS, ISO/IEC 42001, NIST AI RMF and four other frameworks ^[13] lets teams answer the questionnaire by cross-reference and change nothing at install time. What would falsify the thesis: a vendor demonstrating prose-intent detection with a false-positive rate low enough to gate installs, at which point allowlisting is the wasted build.