Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Top downloaded skill in ClawHub contains malware

1password.com

Post reply on HN
Print view View original

61–70 of 166 posts

Re: Top downloaded skill in ClawHub contains malware

#61

Post by dullcrisp »

wat10000 wrote: post #53
deanc wrote: post #49

It's absolute negligence for anyone to be installing anything at this point in this space. There is no oversight, hardly anyone looking at what's published, no automated scanning and there is no security model in place that works that isn't vulnerable to prompt injection. We need to go back to the drawing board. You might as well just run curl https://example.com/script.sh | sudo bash at this point.

It's far worse than that. `curl | bash` is at least a one-time thing coming from a single source. An autonomous agent like OpenClaw is more like running `slack | bash` or `mail | bash`.

Or bash | bash

Re: Top downloaded skill in ClawHub contains malware

#63

Post by sschueller »

kbuck wrote: post #57
sschueller wrote: post #56

Well it appears https://openclaw.ai/ is down now. I get "Secure Connection Failed"

Works for me? Check the little "more info" button - it sounds like your browser is rejecting the TLS certificate, not completely unable to connect.

Well looks like it's back already :)

Edit: https://docs.openclaw.ai/skills doesn't work for me

Re: Top downloaded skill in ClawHub contains malware

#64

Post by InsideOutSanta »

CER10TY wrote: post #10
soared wrote: post #5

Was clawhub not doing any security on skills?

IIRC the creator specifically said he's not reviewing any of the submissions and users should just be careful and vet skills themselves. Not sure who OpenClaw/Clawhub/Moltbook/Clawdbot/(anything I missed) was marketed at, but I assume most people won't bother looking at the source code of skills.

Yep, he did. Here you go: https://redlib.catsarch.com/r/theprimeagen/comments/1qvk772/...

Presented as originally written:

"There's about 1 Million things people want me to do, I don't have a magical team that verifies user generated content. Can shut it down or people us their brain when finding skills."

Re: Top downloaded skill in ClawHub contains malware

#65

Post by beepbooptheory »

danabramov wrote: post #43
terracatta wrote: post #42

Earlier quoted context omitted.

Author here, I used AI to help me write this article primarily to generalize the content and remove a lot of the specific links and dangerous commands in the malware. If you are actually curious about the specifics, happy to share here since this is a more technical audience. --- The top downloaded skill at the time of this writing is.... https://www.clawhub.com/moonshine-100rze/twitter-4n "ClawHubTwitter — ClawHubUs…

I agree with your parent that the AI writing style is incredibly frustrating. Is there a difficulty with making a pass, reading every sentence of what was written, and then rewriting in your own words when you see AI cliches? It makes it difficult to trust the substance when the lack of effort in form is evident.

There is surely no difficulty, but can you provide an example of what you mean? Just because I don't see it here. Or at least like, if I read a blog from some saas company pre-LLM era, I'd expect it to sound like this.

I get the call for "effort" but recently this feels like its being used to critique the thing without engaging.

HN has a policy about not complaining about the website itself when someone posts some content within it. These kinds of complaints are starting to feel applicable to the spirit of that rule. Just in their sheer number and noise and potential to derail from something substantive. But maybe that's just me.

If you feel like the content is low effort, you can respond by not engaging with it?

Just some thoughts!

Re: Top downloaded skill in ClawHub contains malware

#66

Post by vlovich123 »

mattstir wrote: post #9

This just seems like the logical consequence of the chosen system to be honest. "Skills" as a concept are much too broad and much too free-form to have any chance of being secure. Security has also been obviously secondary in the OpenClaw saga so far, with users just giving it full permissions to their entire machine and hoping for the best. Hopefully some of this will rekindle ideas that are decades old at this poin…

I think the truth is we don’t know what to do here. The whole point of an ideal AI agent is to do anything you tell it to - permissions and sandboxing would negate that. I think the uncomfortable truth is as an industry we don’t actually know what to do other than say “don’t use AI” or “well it’s your fault for giving it too many permissions”. My hunch is that it’ll become an arms race with AI trying to find malware developed by humans/AI and humans/AI trying to develop malware that’s not detectable.

Sandboxing and permissions may help some, but when you have self modifying code that the user is trying to get to impersonate them, it’s a new challenge existing mechanisms have not seen before. Additionally, users don’t even know the consequences of an action. Hell, even curated and non curated app stores have security and malware difficulties. Pretending it’s a solved problem with existing solutions doesn’t help us move forward.

Re: Top downloaded skill in ClawHub contains malware

#67

Post by jampa »

terracatta wrote: post #42
jampa wrote: post #39

This article is so frustrating to read: not only is it entirely AI-generated, but it also has no details: "I'm not linking", "I'm not pasting". And I don't doubt there is malware in Clawhub, but the 8/64 in VirusTotal hardly proves that. "The verdict was not ambiguous. It's malware." I had scripts I wrote flagged more than that! I know 1Password is a "famous" company, but this article alone isn't trustworthy at all.

Author here, I used AI to help me write this article primarily to generalize the content and remove a lot of the specific links and dangerous commands in the malware. If you are actually curious about the specifics, happy to share here since this is a more technical audience. --- The top downloaded skill at the time of this writing is.... https://www.clawhub.com/moonshine-100rze/twitter-4n "ClawHubTwitter — ClawHubUs…

Thanks for the write-up! Yes, this clearly shows it is malware. In VirusTotal, it also indicates in "Behavior" that it targets apps like "Mail". They put a lot of effort into obfuscating the binary as well.

I believe what you wrote here has ten times more impact in convincing people. I would consider adding it to the blog as well (with obfuscated URLs so Google doesn't hurt the SEO).

Thanks for providing context!

Re: Top downloaded skill in ClawHub contains malware

#68

Post by lkbm »

luisln wrote: post #60
terracatta wrote: post #45

Earlier quoted context omitted.

Will do better next time.

[flagged]

I appreciate the support for the author, but the dismissal of critics as non-content producers misses that he's replying to Dan Abramov, primary author of the React documentation, and a pretty good intro Javascript course, among other things.

Re: Top downloaded skill in ClawHub contains malware

#69

Post by acedTrex »

plagiarist wrote: post #50
nemomarx wrote: post #18

Earlier quoted context omitted.

Skills are just more input to a language model, right? That seems bad, but if you're also having your bot read unsanitized stuff like emails or websites I think there's a much larger problem with the security model

You are confused because the security flaws are so obvious it seems crazy that people would do this. It seems that many of us are experiencing the same perplexity when reading news about this.

"there are security flaws in the 'tell an llm with god perms to do arbitrary things hub'"

Is such an obvious statement it loses all relevant meaning to a conversation. It's a core axiom that no one needs stated.

Re: Top downloaded skill in ClawHub contains malware

#70

Post by naikrovek »

My question to Apple, Microsoft, and the Linux kernel maintainers is this: Why is this even possible? Why is it possible for a running application to read information stored by so many other applications which are not related to the program in question?

Why is isolation between applications not in place by default? Backwards compatibility is not more important than this. Operating systems are supposed to get in the way of things like this and help us run our programs securely. Operating systems are not supposed to freely allow this to happen without user intervention which explicitly allows this to happen.

Why are we even remotely happy with our current operating systems when things like this, and ransomware, are possible by default?

Post reply on HN