Librarian Catches Thief: Surfacing Supply Chain Attack Campaigns via Document Similarity in an AI Agent Skill Registry

Supply chain attack campaigns mass-produce their artifacts, and mass production leaves a structural trace: hundreds of near-identical files. In AI agent skill marketplaces, which distribute capabilities as natural-language instruction files following the Agent Skills standard (an open format adopted by over 30 platforms), the artifact carrying that trace is a document, and the trace is detectable by document similarity alone. None of the marketplaces examined in this study documented deduplication or similarity checking at ingest. In early 2026, threat actors uploaded hundreds of skills to the ClawHub registry for the OpenClaw agent framework, directing users to install credential-stealing malware. A MinHash locality-sensitive hashing pipeline processed 31,634 skill files from the ClawHub registry and 31 community repositories with the scanner and hash parameters untuned. At a 90% Jaccard threshold, selected from a sweep, 2,622 similarity clusters contained 7,147 file memberships across 7,061 distinct files, 22.3%, and all 337 Koi-documented malicious skills present in the corpus appeared in a cluster, a within-archive recall expected by construction for template-reuse campaigns. Among the 38 clusters containing at least 10 files, 30 contained confirmed malicious content (78.9%, 95% CI [63.7, 88.9]), and every cluster with 20 or more files was malicious (11 clusters, ten of them subclusters of one campaign; 95% CI [74.1, 100]). These results show that similarity clustering, established in code registries, transfers to text-based ecosystems where campaigns reuse templates at scale. Mirror commit history suggests the largest campaign's cluster was forming as the campaign was disclosed. Document similarity thus offers a lightweight, signature-free first pass for publish-time security screening in text-based registries.