Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Top downloaded skill in ClawHub contains malware

1password.com

Post reply on HN
Print view View original

21–30 of 166 posts

Re: Top downloaded skill in ClawHub contains malware

#21

Post by voidUpdate »

VladVladikoff wrote: post #13

To me the appeal of something like OpenClaw is incredible! It fills a gap that I’ve been trying to solve where automating customer support is more than just reacting to text and writing text back, but requires steps in our application backend for most support enquiries. If I could get a system like OpenClaw to read a support ticket, open a browser and then do some associated actions in our application backend, and th…

You are trusting a system that can be social engineered by asking nicely with your application backend. If a customer can simply put in their support ticket that they want the LLM to do bad things to your app, and the LLM will do it, Skills are the least of your worries

Re: Top downloaded skill in ClawHub contains malware

#23

Post by codefreakxff »

nemomarx wrote: post #18
mattstir wrote: post #9

This just seems like the logical consequence of the chosen system to be honest. "Skills" as a concept are much too broad and much too free-form to have any chance of being secure. Security has also been obviously secondary in the OpenClaw saga so far, with users just giving it full permissions to their entire machine and hoping for the best. Hopefully some of this will rekindle ideas that are decades old at this poin…

Skills are just more input to a language model, right? That seems bad, but if you're also having your bot read unsanitized stuff like emails or websites I think there's a much larger problem with the security model

No, skills are telling the model how to run a script to do something interesting. If you look at the skillshub the skills you download can include python scripts, bash scripts... i didn't look too much further after downloading a skill to get the gist of what they had done to wire everything up, but this is definitely not taking security into consideration

Re: Top downloaded skill in ClawHub contains malware

#25

Post by nemomarx »

tkhapz wrote: post #11

Since increasingly every "successful" application is a form of an insecure, overcomplicated computer game: How do you get the mindset to develop such applications? Do you have to play League of Legends for 8 hours per day as a teenager? Do you have to be a crypto bro who lost money on MtGox? People in the AI space seem literally mentally ill. How does one acquire the skills (pun intended) to participate in the madnes…

I mean as long as you're not using it yourself you're not at any real risks, right? The ethos seems to be to just try things and not worry about failing or making mistakes. You should free yourself from the anxiety of those a little bit.

Think about the worst thing your project could do, and remind yourself you'd still be okay if that happened in the wild and people would probably forget about it soon anyway.

Re: Top downloaded skill in ClawHub contains malware

#26

Post by thepasch »

Sometimes it feels like the advent of LLMs is hyperboosting the undoing of decades of slow societal technical literacy that wasn't even close to truly taking foot yet. Though LLMs aren't the reason; they're just the latest symptom.

For a while it felt like people were getting more comfortable with and knowledgeable about tech, but in recent years, the exact opposite has been the case.

Re: Top downloaded skill in ClawHub contains malware

#27

Post by fl0ki »

CER10TY wrote: post #10
soared wrote: post #5

Was clawhub not doing any security on skills?

IIRC the creator specifically said he's not reviewing any of the submissions and users should just be careful and vet skills themselves. Not sure who OpenClaw/Clawhub/Moltbook/Clawdbot/(anything I missed) was marketed at, but I assume most people won't bother looking at the source code of skills.

Somehow I doubt the people who don't even read the code their own agent creates were saving that time to instead read the code of countless dependencies across all future updates.

Re: Top downloaded skill in ClawHub contains malware

#28

Post by fnoef »

It feels like the early days of crypto. It promised to be the revolution, but ended up being used for black markets, with malware that use your Madison to mine crypto or steal crypto.

I wonder if in few years from now, we will look back and wonder how we got psyoped into all this

Re: Top downloaded skill in ClawHub contains malware

#29

Post by hackyhacky »

fnoef wrote: post #28

It feels like the early days of crypto. It promised to be the revolution, but ended up being used for black markets, with malware that use your Madison to mine crypto or steal crypto. I wonder if in few years from now, we will look back and wonder how we got psyoped into all this

> I wonder if in few years from now, we will look back and wonder how we got psyoped into all this

I hope so but it's unlikely. AI actually has real world use cases, mostly for devaluing human labor.

Unlike crypto, AI is real and is therefore much more dangerous.

Re: Top downloaded skill in ClawHub contains malware

#30

Post by fnoef »

hackyhacky wrote: post #29
fnoef wrote: post #28

It feels like the early days of crypto. It promised to be the revolution, but ended up being used for black markets, with malware that use your Madison to mine crypto or steal crypto. I wonder if in few years from now, we will look back and wonder how we got psyoped into all this

> I wonder if in few years from now, we will look back and wonder how we got psyoped into all this I hope so but it's unlikely. AI actually has real world use cases, mostly for devaluing human labor. Unlike crypto, AI is real and is therefore much more dangerous.

Well, I agree. But I also hope that maybe we find out that it simply is not economically viable to AI all the things
Post reply on HN