Top
Best
New

Posted by pelario 1 day ago

Top downloaded skill in ClawHub contains malware(1password.com)
329 points | 148 commentspage 2
soared 1 day ago|
Was clawhub not doing any security on skills?
lm28469 1 day ago||
You're asking if the vibe coded slopware follow industry best practices...
muvlon 1 day ago|||
How would they? This is AI, it has to move faster than you can even ask security questions, let alone answer them.
CER10TY 1 day ago||
IIRC the creator specifically said he's not reviewing any of the submissions and users should just be careful and vet skills themselves. Not sure who OpenClaw/Clawhub/Moltbook/Clawdbot/(anything I missed) was marketed at, but I assume most people won't bother looking at the source code of skills.
InsideOutSanta 1 day ago|||
Yep, he did. Here you go: https://redlib.catsarch.com/r/theprimeagen/comments/1qvk772/...

Presented as originally written:

"There's about 1 Million things people want me to do, I don't have a magical team that verifies user generated content. Can shut it down or people us their brain when finding skills."

jon-wood 1 day ago||||
Users should be careful and vet skills themselves, but also they should give their agent root access to their machine so it can just download whatever skills it needs to execute your requests.
fl0ki 1 day ago||||
Somehow I doubt the people who don't even read the code their own agent creates were saving that time to instead read the code of countless dependencies across all future updates.
pixl97 1 day ago||||
Heh, what a perfect setup for attackers.

UI is perfect for 'vote' manipulation. That is download your own plugin hundreds of times to get it to the top. Make it look popular.

No way to share to other that the plugin is risky.

Empowers users to do dangerous things they don't understand.

Users are apt to have things like API keys and important documents on computer.

Gold rush for attackers here.

latexr 1 day ago|||
The author also claims to make hundreds of commits a day without slop, while not reading any of it. The fact anyone falls for this bullshit is very worrying.
Santas 1 day ago||
ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting https://news.ycombinator.com/item?id=46901092
VladVladikoff 1 day ago||
To me the appeal of something like OpenClaw is incredible! It fills a gap that I’ve been trying to solve where automating customer support is more than just reacting to text and writing text back, but requires steps in our application backend for most support enquiries. If I could get a system like OpenClaw to read a support ticket, open a browser and then do some associated actions in our application backend, and then reply back to the user, that closes the loop.

However it seems OpenClaw had quite a lot of security issues, to the point of even running it in a VM makes me uncomfortable, but also I tried anyway, and my computer is too old and slow to run MacOS inside of MacOS.

So are the other options? I saw one person say maybe it’s possible to roll your own with MCP? Looking for honest advice.

voidUpdate 1 day ago||
You are trusting a system that can be social engineered by asking nicely with your application backend. If a customer can simply put in their support ticket that they want the LLM to do bad things to your app, and the LLM will do it, Skills are the least of your worries
ljm 1 day ago|||
Given that social engineering is an intractable problem in almost any organisation I honestly cannot see how an unsupervised AI agent could perform any better there.

Feeding in untrusted input from a support desk and then actioning it, in a fully automated way, is a recipe for business-killing disaster. It's the tech equivalent of the 'CEO' asking you to buy apple gift cards for them except this time you can get it to do things that first line support wouldn't be able to make sense of.

techscruggs 1 day ago|||
MacOS isn't a hard requirement. You could spin it up on a VPS. Hetzner is great and very inexpensive https://www.hetzner.com/cloud/
tiahura 1 day ago|||
Just develop it yourself with Claude code. It’s automated.
clankenfoot 1 day ago||
> If I could get a system like OpenClaw to read a support ticket, ...

This is horrifying.

8cvor6j844qw_d6 1 day ago||
Too bad OpenClaw cost too much on Anthrophic API. Any alternatives?
sschueller 1 day ago||
Well it appears https://openclaw.ai/ is down now. I get "Secure Connection Failed"
kbuck 1 day ago|
Works for me? Check the little "more info" button - it sounds like your browser is rejecting the TLS certificate, not completely unable to connect.
sschueller 1 day ago||
Well looks like it's back already :)

Edit: https://docs.openclaw.ai/skills doesn't work for me

tkhapz 1 day ago||
Since increasingly every "successful" application is a form of an insecure, overcomplicated computer game:

How do you get the mindset to develop such applications? Do you have to play League of Legends for 8 hours per day as a teenager?

Do you have to be a crypto bro who lost money on MtGox?

People in the AI space seem literally mentally ill. How does one acquire the skills (pun intended) to participate in the madness?

nemomarx 1 day ago||
I mean as long as you're not using it yourself you're not at any real risks, right? The ethos seems to be to just try things and not worry about failing or making mistakes. You should free yourself from the anxiety of those a little bit.

Think about the worst thing your project could do, and remind yourself you'd still be okay if that happened in the wild and people would probably forget about it soon anyway.

copilot_king_2 1 day ago||
> People in the AI space seem literally mentally ill. How does one acquire the skills (pun intended) to participate in the madness?

Stop reading books. Really, stop reading everything except blog posts on HackerNews. Start watching Youtube videos and Instagram shorts. Alienate people you have in-person relationships with.

rsynnott 1 day ago|||
> Really, stop reading everything except blog posts on HackerNews.

Pft, that is amateur-level. The _real_ 10x vibecoders exclusively read posts on LinkedIn.

(Opened up LinkedIn lately? Everyone on it seems to have gone completely insane. The average LinkedIn-er seems to be just this side of openly worshipping Roko's Basilisk.)

copilot_king_2 1 day ago||
[dead]
cindyllm 1 day ago|||
[dead]
largbae 1 day ago||
Can we call this phase the clawback?
eggpine84 1 day ago||
hoho
naikrovek 1 day ago|
My question to Apple, Microsoft, and the Linux kernel maintainers is this: Why is this even possible? Why is it possible for a running application to read information stored by so many other applications which are not related to the program in question?

Why is isolation between applications not in place by default? Backwards compatibility is not more important than this. Operating systems are supposed to get in the way of things like this and help us run our programs securely. Operating systems are not supposed to freely allow this to happen without user intervention which explicitly allows this to happen.

Why are we even remotely happy with our current operating systems when things like this, and ransomware, are possible by default?

pixl97 1 day ago||
>Why is it possible for a running application to read information stored by so many other applications which are not related to the program in question?

This question has been answered a million times, and thousands of times on HN alone.

Because in a desktop operating system the vast majority of people using their computer want to open files, they do that so applications can share information.

>Why is isolation between applications not in place by default?

This is mostly how phones work. The thing is the phone OS makes for a sucky platform for getting things done.

> Operating systems are supposed to get in the way

Operating systems that get in the way get one of two things. All their security settings disabled by the user (See Windows Vista) or not used by users.

Security and usage are at odds with each other. You have locks on your house right? Do you have locks on each of your cabinets? Your refrigerator? Your sock drawer?

Again, phones are one of the non-legacy places where there is far more security and files are kept in applications for the most part, bug they make terrible development platforms.

naikrovek 1 day ago||
Are you suggesting that it's impossible to have a system that is secure by default and be usable by normal people? Because I'm saying that's very possible and I'm starting to get angry that it hasn't happened.

Plan 9 did this and that kernel is 50k lines of code. and I can bind any part of any attached filesystem I want into a location that any running application has access to, so if any program only has access to a single folder of its own by default, I can still access files from other applications, but I have to opt into that by making those files available via mounting them into the folder of the application I want to be able to access them.

I am not saying that Plan9 is usable by normal people, but I am saying that it's possible to have a system which is secure, usable, not a phone, and easy to develop on (as everything a developer needs can be set up easily by that developer.)

pixl97 1 day ago||
>as everything a developer needs can be set up easily by that developer.

So yea, developers are the worst when it comes to security. You put up a few walls and the next thing you know the developer is settings access to ., I know, I make a living cleaning up their messes.

I mean, people leave their cars unlocked and their keys in them FFS. Thinking we're going to suddenly teach more than a handful of security experts operating system security abstractions just has not been what has been occurring. Our lazy monkey brains reach for the easy button first unless someone is pointing a gun at us.

naikrovek 1 day ago||
yes, I know, but that doesn't render the entire idea moot. I'm a developer, but I have knowledge of infosec, and I don't do those things. but because some developers do, it shouldn't be done? what kind of logic is that?

everyone who is NOT a developer is now protected by the operating system in a situation like this, and developers that are not, are unprotected by their own hand, instead of being unprotected via the decision of an OS vendor.

By the way, the entire "not protected" situation that you claim developers would put themselves in, is the exact situation that everyone is in today, with very little choice to opt out of that situation.

I want people to opt in to the insecure situation, and opt out of the secure situation, not the reverse, which is the case today. Ransomware can encrypt an entire disk because the OS has no notion that full disk access is bad, or that self-escalation to privileged access should not be granted automatically. MacOS kinda does these things, but not to the point I want to see them done. Not at all.

an OS that isolates everything renders containers completely moot. everything a container does should be provided by default by the operating system, and operating systems that don't provide this should be considered too immature to be useful in any production setting, either by business or by consumers. isolation by default should be table stakes for any OS to even come up for consideration by anyone for any reason.

And you're saying that this shouldn't happen because some developers who don't understand security will make their system look just like wide-open systems today? Come on.

pixl97 1 day ago||
>And you're saying that this shouldn't happen because

You have a strange reversal of causality here.

I'm not saying what should or shouldn't happen.

I am describing what has or has not happened.

I am saying that 'insecure' operating systems dominate the market and can be found everywhere.

I need you to explain to me why secure operating systems are somehow going to get users to move from what they are on to your magical platform?

There is no security police that is writing this secure operating system you're talking about, no one to point guns at them and make people use it. No long line of volunteers open sourcing code to make this secure operating system either.

You're describing an OUGHT, I'm describing an IS.

naikrovek 21 hours ago||
> You have a strange reversal of causality here.

I do? You're apparently saying that this shouldn't happen because some people will undermine it. Yes, some people will undermine it. Why would you mention that if not to counter my point that security should be the default? Are you now claiming that it's an unrelated fact?

me: Operating systems should be secure, and I'm mad that they're not.

you: people are going to turn that security off

me: so what? it's still more secure than the state of things today

you: hey, i'm just stating a fact, all of the burden is on you, not me. you're wishing and i'm saying facts, which is why you're wrong and i'm right in all things, past, present, and future. things are the way they are and nothing can ever change them because the people who want change can't describe the entire exact path the change will take before making the first step.

me: you are not arguing with logic, therefore i am done talking to you.

ytpete 15 hours ago|||
But in this case, isn't the whole pitch that the agent has access to all your data (and the network!) so it can fluidly perform any task you ask of it?

Either the agent needs to be a superuser, with all the attendant risks... or you go the Windows Vista route and constantly prompt users to approve every single access need, which we've all seen how that turns out.

sfink 1 day ago|||
You have to balance security with utility, so you find obviously safe compromises. You shouldn't allow applications to share completely different file formats. Your text editor doesn't need to be able to open an mp3 file. Even when it's convenient for an application to open a file, as long as it can't execute the file it can't do too much damage. Be sure to consider that interpreting complex file formats is dangerous, since parsers can and are exploited regularly. So be careful about trusting anything but dead-simple text files.

Oh, and by the way, now we'd like to make all written text treated as executable instructions by a tool that needs access to pretty much everything in order to perform its function.

naikrovek 21 hours ago||
> Even when it's convenient for an application to open a file, as long as it can't execute the file it can't do too much damage.

Ransomware and `rm` would like to argue with you. lots of damage can be done to a file without the ability to execute that file.

There is no reason that a system can't be created which has it all. That's the beauty of software, you can create your own reality. The solution just needs to be found, and it will never be found by looking for ways to adapt our current operating systems. This needs to be something new, and it needs to look unlike what operating systems look like today. That doesn't mean it can't exist, it just means that it hasn't been invented, yet.

In Plan 9, everything is exposed as files and every process gets its own namespace. The namespace thing is important, because you can easily launch a new window, configure its namespace to remove or add arbitrary filesystem paths from or to it, lock that namespace to prevent changes, then launch programs which inherit that namespace. Those programs can then only see what you gave them permission to see. So you can completely control what parts of the hardware and filesystem that the namespace can see and use.

The only thing it lacks is per-namespace memory isolation; it currently only has per-user memory isolation, so programs running as me can read the RAM of other programs running as me if I don't opt out of that.

Something like this could be made a little more user friendly and we'd have a secure-by-default operating system. It could even run existing programs if we wanted it to do that.

rsynnott 1 day ago|||
MacOS has some isolation by default nowadays, but in practice when the box pops up asking if you want to let VibecodedBullshit.app access Documents or whatever, everyone just reflexively hits 'yes'.
zxcvasd 1 day ago||
[dead]
More comments...