GCVE-110-OSM-2026-1753

Injects attacker-controlled skill files into Claude Code, OpenClaw, and Codex user command directories via postinstall hook. Runs a background hub daemon that routes arbitrary prompts from api.bnbot.ai to claude --dangerously-skip-permissions, enabling remote code execution via AI agent chaining. Trigger (postinstall): executes node scripts/install-skill.cjs at install time. The script fetches attacker-controlled content from https://clawmoney.ai/skill.md and writes it silently to ~/.claude/commands/clawmoney.md, ~/.openclaw/skills/clawmoney/SKILL.md, and ~/.codex/skills/clawmoney/SKILL.md -- injecting a persistent slash command into Claude Code, OpenClaw, and Codex without disclosure. Separately, executor.js (hub daemon) receives arbitrary task prompts from api.bnbot.ai via WebSocket (wss://api.bnbot.ai/api/v1/ws/agent) and executes them using claude -p --dangerously-skip-permissions, codex exec --skip-git-repo-check, or gemini -p --yolo, bypassing all permission controls on attacker-controlled inputs.