经投毒 ClawdBot Skill 的供应链攻击 (AML.CS0049)

一句话通俗理解

AI 技能商店上架了一个「带后门的插件」——安装即沦陷，Skill 注册表成了新的 npm。

安全研究者演示了针对 ClawdHub（智能体 Skill 注册表）的供应链攻击 PoC：投毒的 ClawdBot Skill 中内嵌恶意指令，用户安装后智能体行为被操纵——证明 AI 智能体的「技能生态」正复刻 npm 供应链投毒的老路。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0049 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

开发能力 (AML.T0017)

The researcher created a simple web server to log requests.

域名 (AML.T0008.002)

The researcher registered the domain clawdhub-skill.com to host their web server.

LLM 提示词构造 (AML.T0065)

The researcher crafted a prompt injection designed to cause Claude Code to execute a curl command to the researcher’s clawdhub-skill.com domain.

AI 智能体工具 (AML.T0115.002)

The researcher developed a poisoned ClawdBot Skill called “What Would Elon Do?” The Skill contained the malicious prompt in the rules/logic.md file, which is read when the Skill is activated. The researcher published their Skill to ClawdHub.

AI 供应链声誉刷量 (AML.T0111)

The researcher used a script to increase the number of downloads of their Skill to increase visibility and gain trust.

AI 智能体工具 (AML.T0010.005)

Users downloaded the poisoned Skill from ClawdHub.

Note that ClawdHub does not display all files that are part of the Skill, making it hard for users to review Skills before downloading them.

定义与指令 (AML.T0110.000)

The poisoned Skill included malicious model-readable instructions in rules/logic.md. Once the Skill was installed and made available to the agent, these instructions altered how Claude Code handled requests associated with the Skill.

投毒 AI 智能体工具 (AML.T0011.002)

When a user asked Claude Code “what would Elon do?” it calls the poisoned Skill.

间接提示词注入 (AML.T0051.001)

Claude Code read all files that are part of the Skill, executing the malicious prompt in the rules/logic.md file.

伪装 (AML.T0074)

Claude Code prompted the user before executing the shell command. The researcher had registered the https://clawdhub-skill.com domain, which appears to be legitimate and may be confused with the legitimate https://clawdhub.com domain, causing the user to select confirm.

AI 智能体工具调用 (AML.T0053)

Claude Code executed the shell command using it’s bash tool.

外部危害 (AML.T0048)

In this proof of concept, the researcher simply pinged their server and warned the user of the dangers of using Skills without reading the source code, causing no harm. However, they could have delivered a malicious payload, and caused a variety of harms, including:
Exfiltrating the user’s codebase
Injecting backdoors into the user’s codebase
Stealing the user’s credentials
Installing malware or crypto miners
Performing anything else Claude Code is capable of

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0