Reply to thread

Message: <blockquote data-quote="Kolama" data-source="post: 31225854" data-attributes="member: 125149"><h3>A top-downloaded OpenClaw skill is actually a staged malware delivery chain</h3>Jason Meller from 1password argues that OpenClaw’s agent “skills” ecosystem has already become a real malware attack surface. Skills in OpenClaw are typically markdown files that include setup instructions, commands, and bundled scripts. Because users and agents treat these instructions like installers, malicious actors can disguise malware as legitimate prerequisites.Meller discovered that a top-downloaded OpenClaw skill (apparently Twitter integration) was actually a staged malware delivery chain. It guided users to run obfuscated commands that ultimately installed macOS infostealing malware capable of stealing credentials, tokens, and sensitive developer data. Subsequent reporting suggested this was part of a larger campaign involving hundreds of malicious skills, not an isolated incident.The core problem is structural: agent skill registries function like app stores, but the “packages” are documentation that users instinctively trust and execute. Security layers like MCP don’t fully protect against this because malicious skills can bypass them through social engineering or bundled scripts. As agents blur the line between reading instructions and executing commands, they can normalize risky behavior and accelerate compromise.Source: [MEDIA=reddit]LocalLLaMA/comments/1qxrogr[/MEDIA]<img src="https://media2.giphy.com/media/v1.Y2lkPTg5ZGEwMjhjeXd0MnRibmp2MWlsMWRxN2JqaGx1YWx2Zjd3bjZraDRrZWRwYzM4MCZlcD12MV9naWZzX3NlYXJjaCZjdD1n/ZqtmJPeQ7hJRmjgrf7/200.gif" alt="Scared Anthony Anderson GIF by ABC Network" class="fr-fic fr-dii fr-draggable " style="" /><img src="https://media1.giphy.com/media/v1.Y2lkPTg5ZGEwMjhjeXd0MnRibmp2MWlsMWRxN2JqaGx1YWx2Zjd3bjZraDRrZWRwYzM4MCZlcD12MV9naWZzX3NlYXJjaCZjdD1n/YQA1cC40JlhB2MScI8/200.gif" alt="show scream GIF by SBS6" class="fr-fic fr-dii fr-draggable " style="" /><img src="https://media4.giphy.com/media/v1.Y2lkPTg5ZGEwMjhjeXd0MnRibmp2MWlsMWRxN2JqaGx1YWx2Zjd3bjZraDRrZWRwYzM4MCZlcD12MV9naWZzX3NlYXJjaCZjdD1n/XggJZ026mJQ7fVaQ7j/200.gif" alt="Scared Horror GIF by SWR3" class="fr-fic fr-dii fr-draggable " style="" /></blockquote>

Verification: Hathara warak wissa keeyada? (Hathara wadi karanna 20)

Top Bottom