OpenClaw’s Official Plugin Marketplace Faces Name-Squatting Risk

OpenClaw's official plugin marketplace, ClawHub, allows developers to publish skill plugins, but inadequate namespace protections let third parties preemptively register names that appear official. Such impersonation can obscure a plugin's true origin and may lead users to install software that OpenClaw has not verified, creating supply-chain security and account-data leakage risks.

Cybersecurity firms recently identified 23 unofficial skill plugins on ClawHub that used namespace squatting to list themselves under official or highly similar names. After being notified, ClawHub removed the plugins and tightened name reviews and rights-holder complaint procedures. As of July 20, 2026, reports had not disclosed the exact dates of the notification or removals, and no financial losses were reported.