Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ClawHub

clawhub.ai

Post reply on HN
Print view View original

41–43 of 43 posts

Re: ClawHub

#41

Post by sgarland »

isodev wrote: post #19

So let's recap: - I click skills. - The first one is WireGuard "... secure routing and key management". - I'd download it, hook it to this bot running on my system. - I'd ask the bot to store / manage super-secret keys that protect actual servers with user data and personal details and god knows what... - The bot follows my commands by spelunking random snippets of markdown, running other programs on my computer, doi…

> I feel like either I'm missing something substantial or some kind of madness is happening to people

It is WILD how little “professionals” actually understand about systems, security, or really computers in general.

Re: ClawHub

#42

Post by inlustra »

dpoloncsak wrote: post #29
Nextgrid wrote: post #14

Earlier quoted context omitted.

VirusTotal is completely useless for this though? You need enough people to be pwned by that particular piece of malware for it to be flagged as dangerous, by which point the attackers would've already repacked it so it doesn't match the previous signature.

Adding on here... VirusTotal is flagging the trello skill as suspucious because it Does NOT include an API key? Am i expected to share my keys if I want to upload a skill? https://clawhub.ai/steipete/trello "Requiring TRELLO_API_KEY and TRELLO_TOKEN is appropriate for Trello access, but the registry records no required env vars while SKILL.md documents them. This omission is problematic: the skill will need highly pr…

You’ve completely missed the point, it’s saying that the skill will need you to provide a Trello API key but he hasn’t declared that it will need that

Subsequently they’ve included the use of curl but also haven’t declared that either which means that it _could_ leak your key if you provide it one. That’s why it’s suspicious - virus total has flagged that you should probably review the skill.md

Re: ClawHub

#43

Post by dpoloncsak »

inlustra wrote: post #42
dpoloncsak wrote: post #29

Earlier quoted context omitted.

Adding on here... VirusTotal is flagging the trello skill as suspucious because it Does NOT include an API key? Am i expected to share my keys if I want to upload a skill? https://clawhub.ai/steipete/trello "Requiring TRELLO_API_KEY and TRELLO_TOKEN is appropriate for Trello access, but the registry records no required env vars while SKILL.md documents them. This omission is problematic: the skill will need highly pr…

You’ve completely missed the point, it’s saying that the skill will need you to provide a Trello API key but he hasn’t declared that it will need that Subsequently they’ve included the use of curl but also haven’t declared that either which means that it _could_ leak your key if you provide it one. That’s why it’s suspicious - virus total has flagged that you should probably review the skill.md

Oh, I see. Seems obvious you would need an API key in this context but I get the idea that it's an undeclared but required var, which could be shady
Post reply on HN