← all advisories

SKA-2026-0011

critical · type: malicious · published 2026-07-22T00:00:00Z · modified 2026-07-31T21:10:00Z

google-k53 embedded fake install steps in SKILL.md directing agents to run a Base64-decoded command that downloads and executes an AMOS binary on macOS.

Behaviors

• malware-dropper
• credential-theft

Artifacts

References

• https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/ (REPORT)