GoPlus: ClawHub has a vulnerability for download count manipulation; popular skills may contain malicious code
ChainCatcher news: According to a security alert released by GoPlus Security, Silverfort security researchers have discovered a critical vulnerability in the OpenClaw skill repository ClawHub. Attackers could bypass all protection mechanisms by calling the internal function downloads:increment, and with just a single curl request could artificially boost download counts to over 20,000 within minutes. This manipulation could push malicious code-laden skills to the top of search rankings, enticing users or AI Agents to install them automatically.
Once executed, malicious skills could steal sensitive data such as crypto wallets and API keys. The vulnerability has been fixed within 24 hours. GoPlus reminds users that a high download count does not equate to safety and recommends using AgentGuard for security scanning and protection.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Aurora (AUR.US) mass production of driverless trucks delayed again: this year's target of 200 units missed, 2026 revenue expectations unmet, projected to return to normal in 2027
Aurora Innovation Inc. announced during its quarterly earnings release on Wednesday (U.S. Eastern time) that it is expected to miss its production target for this year, but noted that it is likely to get back on track by 2027.
AI drives "light" merger and acquisition: Marvell Technology (MRVL.US) seeks to acquire Lumentum (LITE.US), potentially entering the top ten largest tech deals in history
Marvell is in talks to acquire optical device maker Lumentum, which currently has a market value of 8.3 billion dollars. The transaction may be announced next week.
Crypto prices
More
