GoPlus: ClawHub has a vulnerability for download count manipulation; popular skills may contain malicious code
ChainCatcher news: According to a security alert released by GoPlus Security, Silverfort security researchers have discovered a critical vulnerability in the OpenClaw skill repository ClawHub. Attackers could bypass all protection mechanisms by calling the internal function downloads:increment, and with just a single curl request could artificially boost download counts to over 20,000 within minutes. This manipulation could push malicious code-laden skills to the top of search rankings, enticing users or AI Agents to install them automatically.
Once executed, malicious skills could steal sensitive data such as crypto wallets and API keys. The vulnerability has been fixed within 24 hours. GoPlus reminds users that a high download count does not equate to safety and recommends using AgentGuard for security scanning and protection.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
AI drives "light" merger and acquisition: Marvell Technology (MRVL.US) seeks to acquire Lumentum (LITE.US), potentially entering the top ten largest tech deals in history
Marvell is in talks to acquire optical device maker Lumentum, which currently has a market value of 8.3 billion dollars. The transaction may be announced next week.
Australian Dollar holds above 0.7050 as hot CPI boosts RBA hike bets
Commodity cost headwinds increase to 2.5 billions USD, Ford Motor (F.US) sees core profit edge up 4% against the trend in Q3 and raises its annual guidance lower limit
Ford's Q3 adjusted EPS exceeded expectations by 20%, and the company raised the lower end of its full-year profit guidance to $10.5 billion; however, revenue slightly missed expectations, causing shares to fall nearly 2% after hours.
Crypto prices
More
