Live data from Hacker News

Top downloaded skill in ClawHub contains malware

1password.com

11–20 of 166 posts

Re: Top downloaded skill in ClawHub contains malware

#11
Since increasingly every "successful" application is a form of an insecure, overcomplicated computer game:

How do you get the mindset to develop such applications? Do you have to play League of Legends for 8 hours per day as a teenager?

Do you have to be a crypto bro who lost money on MtGox?

People in the AI space seem literally mentally ill. How does one acquire the skills (pun intended) to participate in the madness?

Re: Top downloaded skill in ClawHub contains malware

#12
post #10
post #5

Was clawhub not doing any security on skills?

IIRC the creator specifically said he's not reviewing any of the submissions and users should just be careful and vet skills themselves. Not sure who OpenClaw/Clawhub/Moltbook/Clawdbot/(anything I missed) was marketed at, but I assume most people won't bother looking at the source code of skills.

Users should be careful and vet skills themselves, but also they should give their agent root access to their machine so it can just download whatever skills it needs to execute your requests.

Re: Top downloaded skill in ClawHub contains malware

#13
To me the appeal of something like OpenClaw is incredible! It fills a gap that I’ve been trying to solve where automating customer support is more than just reacting to text and writing text back, but requires steps in our application backend for most support enquiries. If I could get a system like OpenClaw to read a support ticket, open a browser and then do some associated actions in our application backend, and then reply back to the user, that closes the loop.

However it seems OpenClaw had quite a lot of security issues, to the point of even running it in a VM makes me uncomfortable, but also I tried anyway, and my computer is too old and slow to run MacOS inside of MacOS.

So are the other options? I saw one person say maybe it’s possible to roll your own with MCP? Looking for honest advice.

Re: Top downloaded skill in ClawHub contains malware

#15

To me the appeal of something like OpenClaw is incredible! It fills a gap that I’ve been trying to solve where automating customer support is more than just reacting to text and writing text back, but requires steps in our application backend for most support enquiries. If I could get a system like OpenClaw to read a support ticket, open a browser and then do some associated actions in our application backend, and th…

MacOS isn't a hard requirement. You could spin it up on a VPS. Hetzner is great and very inexpensive https://www.hetzner.com/cloud/

Re: Top downloaded skill in ClawHub contains malware

#16

Why are these articles always AI written? What's the point of having AI generate a bunch of filler text?

1) the person is either too lazy to write themselves anymore, when AI can do it in 15 sec after being provided 1 sentence of input, or they adopted a mindset of "bro, if I spent 2 hours writing it, my competitors already generated 50 articles in that time" (or the other variant - "bro, while those fools spend 2 hours to write an article, I'll be churning 50 using AI")

2) They are still, in whatever way, beholden to legacy metrics such as number of words, avg reading time, length of content to allow multiple ad insertion "slots" etc...

Just the other day, my boss was bragging about how he sent a huge email to the client, with ALL the details, written with AI in 3 min, just before a call with them, only for the client on the other side to respond with "oh yeah, I've used AI to summarise it and went through it just now". (Boss considered it rude, of course)

Re: Top downloaded skill in ClawHub contains malware

#17

To me the appeal of something like OpenClaw is incredible! It fills a gap that I’ve been trying to solve where automating customer support is more than just reacting to text and writing text back, but requires steps in our application backend for most support enquiries. If I could get a system like OpenClaw to read a support ticket, open a browser and then do some associated actions in our application backend, and th…

Given that social engineering is an intractable problem in almost any organisation I honestly cannot see how an unsupervised AI agent could perform any better there.

Feeding in untrusted input from a support desk and then actioning it, in a fully automated way, is a recipe for business-killing disaster. It's the tech equivalent of the 'CEO' asking you to buy apple gift cards for them except this time you can get it to do things that first line support wouldn't be able to make sense of.

Re: Top downloaded skill in ClawHub contains malware

#18
post #9

This just seems like the logical consequence of the chosen system to be honest. "Skills" as a concept are much too broad and much too free-form to have any chance of being secure. Security has also been obviously secondary in the OpenClaw saga so far, with users just giving it full permissions to their entire machine and hoping for the best. Hopefully some of this will rekindle ideas that are decades old at this poin…

Skills are just more input to a language model, right?

That seems bad, but if you're also having your bot read unsanitized stuff like emails or websites I think there's a much larger problem with the security model

Re: Top downloaded skill in ClawHub contains malware

#20

To me the appeal of something like OpenClaw is incredible! It fills a gap that I’ve been trying to solve where automating customer support is more than just reacting to text and writing text back, but requires steps in our application backend for most support enquiries. If I could get a system like OpenClaw to read a support ticket, open a browser and then do some associated actions in our application backend, and th…

Just develop it yourself with Claude code. It’s automated.
Post reply on HN