Too bad OpenClaw cost too much on Anthrophic API. Any alternatives?
Top downloaded skill in ClawHub contains malware
71–80 of 166 posts
Re: Top downloaded skill in ClawHub contains malware
#72That's why the Moltbots were panicking earlier. [0]
These 'skills' are yet another bad standard, just when MCP was already a much worse standard than it already was.
Re: Top downloaded skill in ClawHub contains malware
#73Earlier quoted context omitted.
Author here, I used AI to help me write this article primarily to generalize the content and remove a lot of the specific links and dangerous commands in the malware. If you are actually curious about the specifics, happy to share here since this is a more technical audience. --- The top downloaded skill at the time of this writing is.... https://www.clawhub.com/moonshine-100rze/twitter-4n "ClawHubTwitter — ClawHubUs…
Thanks for the write-up! Yes, this clearly shows it is malware. In VirusTotal, it also indicates in "Behavior" that it targets apps like "Mail". They put a lot of effort into obfuscating the binary as well. I believe what you wrote here has ten times more impact in convincing people. I would consider adding it to the blog as well (with obfuscated URLs so Google doesn't hurt the SEO). Thanks for providing context!
You're welcome! I will be writing more about this in the future, and I appreciate your feedback.
Re: Top downloaded skill in ClawHub contains malware
#74Earlier quoted context omitted.
Well, I agree. But I also hope that maybe we find out that it simply is not economically viable to AI all the things
[flagged]
Na, Clankers will take over the job flipping flapjacks at WH. You'll have to get into/record fights with the guests to earn Youtube tips on your videos for a living.
Re: Top downloaded skill in ClawHub contains malware
#75Earlier quoted context omitted.
I agree with your parent that the AI writing style is incredibly frustrating. Is there a difficulty with making a pass, reading every sentence of what was written, and then rewriting in your own words when you see AI cliches? It makes it difficult to trust the substance when the lack of effort in form is evident.
My suspicion is that the problem here is pretty simple: people publishing articles that contain these kinds of LLM-ass LLMisms don't mind and don't notice them. I spotted this recently on Reddit. There are tons of very obviously bot-generated or LLM-written posts, but there are also always clearly real people in the comments who just don't realize that they're responding to a bot.
I see this by far the most on Github out of all places.
Re: Top downloaded skill in ClawHub contains malware
#76Was clawhub not doing any security on skills?
IIRC the creator specifically said he's not reviewing any of the submissions and users should just be careful and vet skills themselves. Not sure who OpenClaw/Clawhub/Moltbook/Clawdbot/(anything I missed) was marketed at, but I assume most people won't bother looking at the source code of skills.
Heh, what a perfect setup for attackers.
UI is perfect for 'vote' manipulation. That is download your own plugin hundreds of times to get it to the top. Make it look popular.
No way to share to other that the plugin is risky.
Empowers users to do dangerous things they don't understand.
Users are apt to have things like API keys and important documents on computer.
Gold rush for attackers here.
Re: Top downloaded skill in ClawHub contains malware
#77Re: Top downloaded skill in ClawHub contains malware
#78This article is so frustrating to read: not only is it entirely AI-generated, but it also has no details: "I'm not linking", "I'm not pasting". And I don't doubt there is malware in Clawhub, but the 8/64 in VirusTotal hardly proves that. "The verdict was not ambiguous. It's malware." I had scripts I wrote flagged more than that! I know 1Password is a "famous" company, but this article alone isn't trustworthy at all.
> I know 1Password is a "famous" company As it always happens, as soon as they took VC money everything started deteriorating. They used to be a prime example of Mac software, now they’re a shell of their former selves. Though I’m sure they’re more profitable than ever, gotta get something for selling your soul.
at the risk of going a bit off topic here, what specifically has deteriorated?
as someone who has used 1password for 10 years or so, i have not noticed any deterioration. certainly nothing that would make me say something like they are a "shell of their former selves'. the only changes i can think of off the top of my head in recent memory were positive, not negative (e.g. adding passkey support). everything else works just as it has for as long as i can remember.
maybe i got lucky and only use features that havent deterioriated? what am i missing?
Re: Top downloaded skill in ClawHub contains malware
#79My question to Apple, Microsoft, and the Linux kernel maintainers is this: Why is this even possible? Why is it possible for a running application to read information stored by so many other applications which are not related to the program in question? Why is isolation between applications not in place by default ? Backwards compatibility is not more important than this. Operating systems are supposed to get in the…
>Why is it possible for a running application to read information stored by so many other applications which are not related to the program in question?
This question has been answered a million times, and thousands of times on HN alone.
Because in a desktop operating system the vast majority of people using their computer want to open files, they do that so applications can share information.
>Why is isolation between applications not in place by default?
This is mostly how phones work. The thing is the phone OS makes for a sucky platform for getting things done.
> Operating systems are supposed to get in the way
Operating systems that get in the way get one of two things. All their security settings disabled by the user (See Windows Vista) or not used by users.
Security and usage are at odds with each other. You have locks on your house right? Do you have locks on each of your cabinets? Your refrigerator? Your sock drawer?
Again, phones are one of the non-legacy places where there is far more security and files are kept in applications for the most part, bug they make terrible development platforms.