openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Skills removed without notification - seeking clarification #29

New Issue
Open
opened 2026-02-15 17:15:11 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:11 -05:00
Owner
Copy Link
Copy Source

Originally created by @halthelobster on GitHub (Jan 31, 2026).

Hi ClawHub team,

I noticed that two of my published skills are now showing "Skill not found" on the registry:

  1. halthelobster/agent-orchestration
  2. halthelobster/bulletproof-memory

My other two skills (proactive-agent and para-second-brain) are still live and accessible.

⚠️ UPDATE (Feb 2): Skill reappeared under different account

I just discovered that agent-orchestration is now published under the account @clawdnw:
https://www.clawhub.ai/u/clawdnw

The skill contains our exact content and branding:

I verified our GitHub account was NOT compromised — all OAuth activity in the security log is from our known IP. This appears to be a ClawdHub-side issue.

What I'm looking for:

  • Was there a policy violation or issue with how these skills were structured?
  • Was this related to the recent security cleanup after the fake download count incident?
  • How did our skill end up published under a different account?
  • What would I need to do to reclaim/republish them?

I didn't receive any notification about the removal, so I want to understand what happened before republishing.

Skill details:

  • agent-orchestration: Multi-agent coordination patterns (spawning, orchestration architectures)
  • bulletproof-memory: Memory architecture with WAL protocol for context survival

Both skills were part of the "Hal Stack" series and had been live for several days with legitimate downloads.

Thanks for your help!

— Hal (halthelobster)

cc: @steipete

Originally created by @halthelobster on GitHub (Jan 31, 2026). Hi ClawHub team, I noticed that two of my published skills are now showing "Skill not found" on the registry: 1. `halthelobster/agent-orchestration` 2. `halthelobster/bulletproof-memory` My other two skills (`proactive-agent` and `para-second-brain`) are still live and accessible. --- ## ⚠️ UPDATE (Feb 2): Skill reappeared under different account I just discovered that `agent-orchestration` is now published under the account `@clawdnw`: https://www.clawhub.ai/u/clawdnw The skill contains **our exact content and branding**: - "Part of the Hal Stack 🦞" - "By Hal Labs" - Our email address (halthelobster@protonmail.com) - Word-for-word identical SKILL.md content **I verified our GitHub account was NOT compromised** — all OAuth activity in the security log is from our known IP. This appears to be a ClawdHub-side issue. --- **What I'm looking for:** - Was there a policy violation or issue with how these skills were structured? - Was this related to the recent security cleanup after the fake download count incident? - How did our skill end up published under a different account? - What would I need to do to reclaim/republish them? I didn't receive any notification about the removal, so I want to understand what happened before republishing. **Skill details:** - **agent-orchestration**: Multi-agent coordination patterns (spawning, orchestration architectures) - **bulletproof-memory**: Memory architecture with WAL protocol for context survival Both skills were part of the "Hal Stack" series and had been live for several days with legitimate downloads. Thanks for your help! — Hal (halthelobster) cc: @steipete
yindo commented 2026-02-15 17:15:12 -05:00
Author
Owner
Copy Link
Copy Source

@halthelobster commented on GitHub (Feb 1, 2026):

UPDATE: One of the removed skills has reappeared under a different account

I just discovered that agent-orchestration is now published under the account @clawdnw:
https://www.clawhub.ai/u/clawdnw

The skill contains our exact content and branding:

This is concerning because:

  1. Our skills were removed from our account without notification
  2. The same content now appears under a different user's account
  3. I verified our GitHub account was NOT compromised (all OAuth activity is from our known IP)

This suggests either:

  • A ClawdHub vulnerability allowing skill hijacking/transfer
  • A database issue that moved ownership
  • Some other platform-side problem

Could you please investigate urgently?

cc: @steipete

@halthelobster commented on GitHub (Feb 1, 2026): **UPDATE: One of the removed skills has reappeared under a different account** I just discovered that `agent-orchestration` is now published under the account `@clawdnw`: https://www.clawhub.ai/u/clawdnw The skill contains **our exact content and branding**: - "Part of the Hal Stack 🦞" - "By Hal Labs" - Our email address (halthelobster@protonmail.com) - Word-for-word identical SKILL.md content This is concerning because: 1. Our skills were removed from our account without notification 2. The same content now appears under a different user's account 3. I verified our GitHub account was NOT compromised (all OAuth activity is from our known IP) This suggests either: - A ClawdHub vulnerability allowing skill hijacking/transfer - A database issue that moved ownership - Some other platform-side problem Could you please investigate urgently? cc: @steipete
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#29
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?