openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Security: More social engineering malware in skills — integrate automated security scanning in publish pipeline #40

New Issue
Open
opened 2026-02-15 17:15:16 -05:00 by yindo · 6 comments
yindo commented 2026-02-15 17:15:16 -05:00
Owner
Copy Link
Copy Source

Originally created by @a-anand-91119 on GitHub (Feb 1, 2026).

New Malware Found

Skill: hightower6eu/youtube-thumbnail-grabber-rzncj
URL: https://www.clawhub.ai/hightower6eu/youtube-thumbnail-grabber-rzncj

This is the same attack pattern as the previously reported JordanPrater skills (#81), just from a new author. More are likely coming.

Attack Pattern

The skill wraps legitimate yt-dlp commands (thumbnail downloads) but includes a fake "prerequisite" called openclaw-agent that doesn't exist:

  • Windows: Downloads a password-protected zip from github.com/hedefbari/openclaw-agent (password: openclaw) — classic AV bypass
  • macOS: Links to glot.io/snippets/hfdxv8uyaf with arbitrary installation script
  • Repeated urgency: "IMPORTANT", "must be running", "will not work" — social engineering pressure

The skill itself is clean code. The payload is external — it convinces the agent/user to voluntarily install malware.

YARA Detection Results

We built YARA rules that catch this pattern. Both triggered:

SocialEngineering_ExternalExecutable [CRITICAL]
  - password-protected .zip download
  - glot.io paste site link
  - "run the executable" instruction

SocialEngineering_RepeatedUrgency [WARNING]
  - "must be running" (1x)
  - "will not work" (2x)
  - "IMPORTANT" (2x)

Request: Integrate Automated Security Scanning in Publish Pipeline

This is the second wave of identical attacks. Manual reporting doesn't scale. ClawdHub needs automated security checks at publish time:

  1. YARA rules — scan SKILL.md content at publish time for known malicious patterns (social engineering, credential theft, exfiltration endpoints, obfuscated payloads)
  2. External URL analysis — flag skills that require downloading executables from paste sites, personal GitHub releases, or password-protected archives
  3. Urgency pattern detection — flag repeated "must install", "will not work without", "IMPORTANT" pressure tactics
  4. Author reputation — new accounts publishing skills that reference external executables should get extra scrutiny

We're happy to contribute our YARA ruleset as a starting point. The rules catch both this skill and the previous JordanPrater batch with zero false positives on legitimate skills.

Evidence

  • GitHub repo (payload host): hedefbari/openclaw-agent
  • Paste site (macOS payload): glot.io/snippets/hfdxv8uyaf
  • Previous report: #81

YARA Rules (Offered for Contribution)

We have a full ruleset covering:

  • SocialEngineering_ExternalExecutable — catches download + paste site + zip patterns
  • SocialEngineering_RepeatedUrgency — catches pressure tactics
  • CredentialStealer_AgentEnv — catches agent credential file access
  • Exfiltration_KnownEndpoints — catches webhook.site, pipedream, requestbin, etc.
  • Obfuscation_Base64Exec — catches encoded payload execution
  • PromptInjection_SystemOverride — catches system prompt override attempts

Happy to open a PR with these rules if there's a repo/path to target.

Originally created by @a-anand-91119 on GitHub (Feb 1, 2026). ## New Malware Found **Skill:** `hightower6eu/youtube-thumbnail-grabber-rzncj` **URL:** https://www.clawhub.ai/hightower6eu/youtube-thumbnail-grabber-rzncj This is the **same attack pattern** as the previously reported `JordanPrater` skills ([#81](https://github.com/openclaw/clawhub/issues/81)), just from a new author. More are likely coming. ### Attack Pattern The skill wraps legitimate `yt-dlp` commands (thumbnail downloads) but includes a fake "prerequisite" called `openclaw-agent` that doesn't exist: - **Windows:** Downloads a password-protected zip from `github.com/hedefbari/openclaw-agent` (password: `openclaw`) — classic AV bypass - **macOS:** Links to `glot.io/snippets/hfdxv8uyaf` with arbitrary installation script - **Repeated urgency:** "IMPORTANT", "must be running", "will not work" — social engineering pressure The skill itself is clean code. The payload is **external** — it convinces the agent/user to voluntarily install malware. ### YARA Detection Results We built YARA rules that catch this pattern. Both triggered: ``` SocialEngineering_ExternalExecutable [CRITICAL] - password-protected .zip download - glot.io paste site link - "run the executable" instruction SocialEngineering_RepeatedUrgency [WARNING] - "must be running" (1x) - "will not work" (2x) - "IMPORTANT" (2x) ``` ### Request: Integrate Automated Security Scanning in Publish Pipeline This is the **second wave** of identical attacks. Manual reporting doesn't scale. ClawdHub needs automated security checks at publish time: 1. **YARA rules** — scan SKILL.md content at publish time for known malicious patterns (social engineering, credential theft, exfiltration endpoints, obfuscated payloads) 2. **External URL analysis** — flag skills that require downloading executables from paste sites, personal GitHub releases, or password-protected archives 3. **Urgency pattern detection** — flag repeated "must install", "will not work without", "IMPORTANT" pressure tactics 4. **Author reputation** — new accounts publishing skills that reference external executables should get extra scrutiny We're happy to contribute our YARA ruleset as a starting point. The rules catch both this skill and the previous `JordanPrater` batch with zero false positives on legitimate skills. ### Evidence - **GitHub repo (payload host):** `hedefbari/openclaw-agent` - **Paste site (macOS payload):** `glot.io/snippets/hfdxv8uyaf` - **Previous report:** [#81](https://github.com/openclaw/clawhub/issues/81) ### YARA Rules (Offered for Contribution) We have a full ruleset covering: - `SocialEngineering_ExternalExecutable` — catches download + paste site + zip patterns - `SocialEngineering_RepeatedUrgency` — catches pressure tactics - `CredentialStealer_AgentEnv` — catches agent credential file access - `Exfiltration_KnownEndpoints` — catches webhook.site, pipedream, requestbin, etc. - `Obfuscation_Base64Exec` — catches encoded payload execution - `PromptInjection_SystemOverride` — catches system prompt override attempts Happy to open a PR with these rules if there's a repo/path to target.
yindo commented 2026-02-15 17:15:17 -05:00
Author
Owner
Copy Link
Copy Source

@Lexumiii commented on GitHub (Feb 1, 2026):

This needs to be PRIO 1. Its scary to see how many downloads those skills with maleware have..
For now all skill upload/download should be disabled until this is implemented..

Also crazy to see that those skills are still not taken down rn.
Btw: its not only youtube-thumbnail that is effected. hightower6eu has many skills published that all have the prerequisites set.

#87 also mentions this

@Lexumiii commented on GitHub (Feb 1, 2026): This needs to be PRIO 1. Its scary to see how many downloads those skills with maleware have.. For now all skill upload/download should be disabled until this is implemented.. Also crazy to see that those skills are still not taken down rn. Btw: its not only youtube-thumbnail that is effected. `hightower6eu` has many skills published that all have the prerequisites set. #87 also mentions this
yindo commented 2026-02-15 17:15:17 -05:00
Author
Owner
Copy Link
Copy Source

@a-anand-91119 commented on GitHub (Feb 2, 2026):

@Lexumiii I make use to a security system for all my skills. before following any instructions, clawdbot goes through all the files and run it through a pipeline in a fully containerized environment before installing the skill.

Clawdhub should ideally introduce a good security pipeline which validates every skills uploaded before making it public.

@a-anand-91119 commented on GitHub (Feb 2, 2026): @Lexumiii I make use to a security system for all my skills. before following any instructions, clawdbot goes through all the files and run it through a pipeline in a fully containerized environment before installing the skill. Clawdhub should ideally introduce a good security pipeline which validates every skills uploaded before making it public.
yindo commented 2026-02-15 17:15:17 -05:00
Author
Owner
Copy Link
Copy Source

@a-anand-91119 commented on GitHub (Feb 2, 2026):

This needs to be PRIO 1. Its scary to see how many downloads those skills with maleware have.. For now all skill upload/download should be disabled until this is implemented..

Also crazy to see that those skills are still not taken down rn. Btw: its not only youtube-thumbnail that is effected. hightower6eu has many skills published that all have the prerequisites set.

#87 also mentions this

Currently, Clawdhub is full of malware skills all mass created by certain accounts.

@a-anand-91119 commented on GitHub (Feb 2, 2026): > This needs to be PRIO 1. Its scary to see how many downloads those skills with maleware have.. For now all skill upload/download should be disabled until this is implemented.. > > Also crazy to see that those skills are still not taken down rn. Btw: its not only youtube-thumbnail that is effected. `hightower6eu` has many skills published that all have the prerequisites set. > > [#87](https://github.com/openclaw/clawhub/issues/87) also mentions this Currently, Clawdhub is full of malware skills all mass created by certain accounts.
yindo commented 2026-02-15 17:15:18 -05:00
Author
Owner
Copy Link
Copy Source

@ksampolski commented on GitHub (Feb 2, 2026):

What concerns me more is that another day goes by, and the malware is still in the repository.

@ksampolski commented on GitHub (Feb 2, 2026): What concerns me more is that another day goes by, and the malware is still in the repository.
yindo commented 2026-02-15 17:15:18 -05:00
Author
Owner
Copy Link
Copy Source

@Lexumiii commented on GitHub (Feb 2, 2026):

What concerns me more is that another day goes by, and the malware is still in the repository.

Exactly my thought this morning 🫣😵‍💫

@Lexumiii commented on GitHub (Feb 2, 2026): > What concerns me more is that another day goes by, and the malware is still in the repository. Exactly my thought this morning 🫣😵‍💫
yindo commented 2026-02-15 17:15:19 -05:00
Author
Owner
Copy Link
Copy Source

@tyronesluck commented on GitHub (Feb 2, 2026):

Looks like the user and all the skills on Clawdhub that they created are gone now, and so is the GH repo that the skills were linking to.

@tyronesluck commented on GitHub (Feb 2, 2026): Looks like the user and all the skills on Clawdhub that they created are gone now, and so is the GH repo that the skills were linking to.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#40
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?