ClawHub, the official plugin center for the OpenClaw AI project, is increasingly targeted by attackers for supply chain poisoning, according to SlowMist monitoring. The platform's insufficient review mechanisms have allowed the infiltration of numerous malicious skills, posing security risks to developers and users. A report by Koi Security identified 341 malicious skills out of 2,857 scans, highlighting a prevalent issue in plugin marketplaces. SlowMist advises caution with installation steps in SKILL.md files and recommends auditing commands, avoiding unknown installation scripts, and obtaining tools from official sources.