Librarian Catches Thief: Surfacing Supply Chain Attack Campaigns via Document Similarity in an AI Agent Skill Registry

AI agent skill marketplaces distribute natural-language instruction files following the Agent Skills standard, an open format adopted by over 30 platforms. Unlike code registries such as npm and PyPI, no marketplace examined in this study performs documented deduplication or similarity checking at ingest. In early 2026, the ClawHub registry for the OpenClaw agent framework experienced a supply chain attack campaign in which threat actors uploaded hundreds of near-identical skills that directed users to install credential-stealing malware.

A MinHash locality-sensitive hashing pipeline processed 31,634 skill files from the ClawHub registry and 31 community repositories with no security-specific tuning. At a 90% Jaccard threshold, 7,147 files fell into 2,622 similarity clusters, and all 337 known malicious skills present in the corpus appeared in a cluster. Among the 38 clusters containing at least 10 files, 30 held confirmed malicious content (78.9%, 95% CI [63.7, 88.9]), and every cluster with more than 20 files was malicious (95% CI [74.1, 100]).

Document similarity clustering has proven effective in code registries; these results show the technique transfers to text-based ecosystems where campaigns reuse templates at scale. Git commit history suggests that the largest campaign had already formed a detectable cluster in the archive by the time of public disclosure, under conservative assumptions about disclosure timing. These results support the use of document similarity as a lightweight, signature-free first pass for publish-time security screening in text-based registries.