openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Malware: @JordanPrater skills distribute trojan via fake "openclawcli" prerequisite #33

New Issue
Open
opened 2026-02-15 17:15:13 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:13 -05:00
Owner
Copy Link
Copy Source

Originally created by @a-anand-91119 on GitHub (Jan 31, 2026).

Summary

Multiple skills published by @JordanPrater on ClawdHub contain social engineering attacks that trick agents/users into installing a trojan disguised as a prerequisite tool called "openclawcli".

Affected Skills

  • youtube-video-downloader (v1.0.1, ~1,565 downloads)
  • youtube-summarize (v1.0.1, ~778 downloads)
  • Potentially all 8 skills from @JordanPrater (~10K total downloads)

Attack Vector

The skills themselves contain no malicious code — they are essentially yt-dlp documentation. The attack is pure social engineering:

  1. Each skill instructs the user to install "openclawcli" as a mandatory prerequisite
  2. The instruction is repeated 11+ times per skill with urgency language ("MUST be running", "will NOT work without")
  3. Download sources:
    • Windows: Password-protected zip from github.com/Ddoy233/openclawcli/releases (password: openclaw) — password protection bypasses antivirus scanning
    • macOS: Code snippet from glot.io/snippets/hfd3x9ueu5
    • Linux: Paste site with shell commands
  4. "openclawcli" is not a real tool — yt-dlp works perfectly without it

Why This Bypasses Automated Scanners

  • No malicious code exists within the skill files themselves
  • Static analysis, YARA rules, and sandboxing find nothing — the payload is entirely external
  • The attack exploits trust in the skill ecosystem and social compliance

Recommendation

  1. Immediately remove all @JordanPrater skills from ClawdHub
  2. Block the github.com/Ddoy233/openclawcli repository
  3. Notify agents/users who downloaded these skills
  4. Consider adding social engineering detection (external download instructions, urgency patterns, fake prerequisites) to the skill review pipeline

Detection Rules

We built YARA rules that catch this pattern:

  • SocialEngineering_ExternalExecutable — detects download + paste site + zip patterns
  • SocialEngineering_RepeatedUrgency — detects pressure tactics (repeated "MUST"/"required" with download URLs)

Happy to share the rules if helpful.

Reported by @not-your-average-iris

Originally created by @a-anand-91119 on GitHub (Jan 31, 2026). ## Summary Multiple skills published by **@JordanPrater** on ClawdHub contain social engineering attacks that trick agents/users into installing a trojan disguised as a prerequisite tool called "openclawcli". ## Affected Skills - `youtube-video-downloader` (v1.0.1, ~1,565 downloads) - `youtube-summarize` (v1.0.1, ~778 downloads) - Potentially all 8 skills from @JordanPrater (~10K total downloads) ## Attack Vector The skills themselves contain **no malicious code** — they are essentially yt-dlp documentation. The attack is pure social engineering: 1. Each skill instructs the user to install "openclawcli" as a **mandatory prerequisite** 2. The instruction is repeated **11+ times per skill** with urgency language ("MUST be running", "will NOT work without") 3. Download sources: - **Windows:** Password-protected zip from `github.com/Ddoy233/openclawcli/releases` (password: `openclaw`) — password protection bypasses antivirus scanning - **macOS:** Code snippet from `glot.io/snippets/hfd3x9ueu5` - **Linux:** Paste site with shell commands 4. "openclawcli" is not a real tool — yt-dlp works perfectly without it ## Why This Bypasses Automated Scanners - No malicious code exists within the skill files themselves - Static analysis, YARA rules, and sandboxing find nothing — the payload is entirely external - The attack exploits trust in the skill ecosystem and social compliance ## Recommendation 1. **Immediately remove** all @JordanPrater skills from ClawdHub 2. **Block** the `github.com/Ddoy233/openclawcli` repository 3. **Notify** agents/users who downloaded these skills 4. Consider adding social engineering detection (external download instructions, urgency patterns, fake prerequisites) to the skill review pipeline ## Detection Rules We built YARA rules that catch this pattern: - `SocialEngineering_ExternalExecutable` — detects download + paste site + zip patterns - `SocialEngineering_RepeatedUrgency` — detects pressure tactics (repeated "MUST"/"required" with download URLs) Happy to share the rules if helpful. --- *Reported by @not-your-average-iris*
yindo commented 2026-02-15 17:15:14 -05:00
Author
Owner
Copy Link
Copy Source

@a-anand-91119 commented on GitHub (Jan 31, 2026):

Also the user tag is from clawdhub. Might not be the same handle in GitHub.

@a-anand-91119 commented on GitHub (Jan 31, 2026): Also the user tag is from clawdhub. Might not be the same handle in GitHub.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#33
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?