Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ClawHub

clawhub.ai

Post reply on HN
Print view View original

31–40 of 43 posts

Re: ClawHub

#31

Post by writeslowly »

dpoloncsak wrote: post #28
free_bip wrote: post #8

Who is scanning these skills for malware? This seems like a prime target for malicious actors.

These are single-file .MDs, right? Written in markdown... Can't you just read it?

I see a number of uploaded skills on the site with bash and python scripts. No idea what runs them

Re: ClawHub

#32

Post by dpoloncsak »

writeslowly wrote: post #31
dpoloncsak wrote: post #28

Earlier quoted context omitted.

These are single-file .MDs, right? Written in markdown... Can't you just read it?

I see a number of uploaded skills on the site with bash and python scripts. No idea what runs them

Oh god...I guess I haven't gotten that deep in the crap yet

Re: ClawHub

#33

Post by Shank »

dpoloncsak wrote: post #27
isodev wrote: post #19

So let's recap: - I click skills. - The first one is WireGuard "... secure routing and key management". - I'd download it, hook it to this bot running on my system. - I'd ask the bot to store / manage super-secret keys that protect actual servers with user data and personal details and god knows what... - The bot follows my commands by spelunking random snippets of markdown, running other programs on my computer, doi…

You're downloading untested code from an unknown user on a random literally just-spun-up 'marketplace' and are shocked when it doesn't work

> I've only been in tech for like 20 years or so but I feel like either I'm missing something substantial or some kind of madness is happening to people.

People are extremely eager for a helpful AI assistant that they are willing to sacrifice security for it. Prompt injection attacks are theoretical until they hit you. Until you're hit you're just having fun riding the wave.

Re: ClawHub

#34

Post by mrbluecoat »

> Upload AgentSkills bundles, version them like npm, and make them searchable with vectors. No gatekeeping, just signal.

Sigh, when I read this and only understand "npm", I feel like retiring.

Re: ClawHub

#35

Post by assimpleaspossi »

mrbluecoat wrote: post #34

> Upload AgentSkills bundles, version them like npm, and make them searchable with vectors. No gatekeeping, just signal. Sigh, when I read this and only understand "npm", I feel like retiring.

Half the stuff posted like this doesn't give a clue what it does at all much less use made up phrases that make no sense (to most of us).

Re: ClawHub

#37

Post by monooso »

dpoloncsak wrote: post #27
isodev wrote: post #19

So let's recap: - I click skills. - The first one is WireGuard "... secure routing and key management". - I'd download it, hook it to this bot running on my system. - I'd ask the bot to store / manage super-secret keys that protect actual servers with user data and personal details and god knows what... - The bot follows my commands by spelunking random snippets of markdown, running other programs on my computer, doi…

You're downloading untested code from an unknown user on a random literally just-spun-up 'marketplace' and are shocked when it doesn't work

I think you misinterpreted GP's comment (or at least the tone).

Re: ClawHub

#38

Post by efilife »

dsrtslnd23 wrote: post #16

[flagged]

Stop spamming. You've been posting this everywhere without even disclosing that it's your site. I'm probably shooting a mail to dang tomorrow to take a look at this
Post reply on HN