GoPlus: ClawHub has a vulnerability for download count manipulation; popular skills may contain malicious code
ChainCatcher news: According to a security alert released by GoPlus Security, Silverfort security researchers have discovered a critical vulnerability in the OpenClaw skill repository ClawHub. Attackers could bypass all protection mechanisms by calling the internal function downloads:increment, and with just a single curl request could artificially boost download counts to over 20,000 within minutes. This manipulation could push malicious code-laden skills to the top of search rankings, enticing users or AI Agents to install them automatically.
Once executed, malicious skills could steal sensitive data such as crypto wallets and API keys. The vulnerability has been fixed within 24 hours. GoPlus reminds users that a high download count does not equate to safety and recommends using AgentGuard for security scanning and protection.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Australia Tests Cross-Border Settlements Using Tokenized Deposits
DHX Company Clarifies Applicant Seeks to Suspend CEO Dismissal Pending Final Ruling
Barclays (BCS.US) bets on a merger between Tesla (TSLA.US) and SpaceX (SPCX.US) in December, but prediction markets give only a 19% probability.
Barclays analyst Levy predicts that Tesla and SpaceX may merge before December to achieve AI integration. However, data from Kalshi and Polymarket indicate that the probability of a short-term merger is very low, with the market favoring such a move after 2027.
Crypto prices
More
