GoPlus: ClawHub has a vulnerability for download count manipulation; popular skills may contain malicious code
ChainCatcher news: According to a security alert released by GoPlus Security, Silverfort security researchers have discovered a critical vulnerability in the OpenClaw skill repository ClawHub. Attackers could bypass all protection mechanisms by calling the internal function downloads:increment, and with just a single curl request could artificially boost download counts to over 20,000 within minutes. This manipulation could push malicious code-laden skills to the top of search rankings, enticing users or AI Agents to install them automatically.
Once executed, malicious skills could steal sensitive data such as crypto wallets and API keys. The vulnerability has been fixed within 24 hours. GoPlus reminds users that a high download count does not equate to safety and recommends using AgentGuard for security scanning and protection.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Raphael Zagury: Bitcoin will eventually surpass gold
Federal Reserve Bowman: AI Brings Both Opportunities and Risks to the Banking Industry, Fed Urges Strengthening of System Security Protections
Federal Reserve Vice Chair for Supervision, Bowman, warned that AI has a dual impact on the banking industry, serving both as a defensive tool and introducing new emerging risks. She urged banks to strengthen basic cybersecurity measures, including updating asset inventories, deploying multi-factor authentication, and improving vulnerability management. Bowman also stated that regulators will continue to adjust their examination approaches, implementing differentiated supervision for community banks instead of imposing blanket mandatory requirements.
FingerMotion to Buy Newbit Technology for $2.3 Million
BUZZ - Pyxis Oncology shares decline after launching equity financing
Crypto prices
More
