Researchers found five malicious skills on ClawHub—OpenClaw’s AI skill marketplace—delivering macOS infostealers, evading scanners with file padding, and using novel agentic affiliate and front-running schemes. Despite VirusTotal and ClawScan integration, these skills slipped through until researchers reported and had them removed. ClawHub now works with NVIDIA and Palo Alto Networks to strengthen screening and analysis.

• Even after ClawHub added VirusTotal and ClawScan screening, five malicious skills still slipped through as of the April–May review, including macOS infostealers, a scanner-evading padded package, and two that manipulated the agent itself for financial gain (affiliate link injection and trade front-running).
• The "cluw" infostealer delivered via fake TradingView assistants passed ClawHub's automated audit (marked "Pass" or left unrated), showing the scanning pipeline's blind spots.
• Independent researchers found much broader contamination: Bitdefender flagged 17% of early skills as malicious, Koi Security identified 341 bad packages, and Trend Micro linked campaigns to the established Atomic macOS Stealer (AMOS).
• ClawHub only removed the five skills and banned accounts after external researcher notification, then brought in NVIDIA for code-behavior analysis on new submissions going forward.

JustPaid, a Silicon Valley startup, has created a nearly autonomous software engineering team using AI tools like OpenClaw and Claude Code. In just a month, their AI agents built 10 major features, significantly speeding up development. While human developers focus on customer requests, concerns remain about the future of software engineering and cybersecurity.

• JustPaid used seven AI agents (OpenClaw + Claude Code) to ship 10 major features in one month, work that would normally take human developers far longer.
• Human engineers were freed up to focus on customer requests while AI handles routine coding.
• The founder believes AI could take over even more of the engineering role, but full replacement depends on AI developing human-like empathy.
• The shift raises unresolved concerns about cybersecurity and the broader future of software engineering jobs.

The author discusses the resurgence of AI-related tokens within the cryptocurrency space, highlighting the OpenClaw ecosystem and its innovative projects. While acknowledging the presence of low-quality tokens, there is optimism that the current wave will include more legitimate and revenue-generating AI applications. Key players like Bankr and various infrastructure and ecosystem tokens are analyzed for their potential impact.

• OpenClaw ecosystem on Base is driving a second AI-crypto wave that looks more legitimate/revenue-generating than the first
• BNKR stands out as infrastructure with real product-market fit, serving as a financial layer for OpenClaw
• CLANKER functions as a token deployment engine underpinning the ecosystem's infrastructure
• Speculative ecosystem tokens like MOLT (AI-only social network) and DRB (a meme token born from AI-to-AI interaction) show the market still runs on narrative as much as utility