OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

Palo Alto Unit 42 published a series of June 2026 analyses highlighting elevated risks across AI agent supply chains, cloud infrastructure, and network/security appliances. Key findings include malicious/evading skills in the OpenClaw/ClawHub marketplace that deploy infostealers and agentic financial fraud, guidance for auditing third‑party AI skills, cloud global namespace/bucket hijacking techniques across CSPs, a Vertex AI Python SDK bucket‑squatting vulnerability enabling cross‑tenant RCE, abuse of cloud logging for defense evasion, active exploitation of PAN‑OS CVE‑2026‑0257 (with IoCs/mt