openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Found a malicious skill uploaded by an user. Including malicious binary report. #42

New Issue
Open
opened 2026-02-15 17:15:16 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:16 -05:00
Owner
Copy Link
Copy Source

Originally created by @plgonzalezrx8 on GitHub (Feb 1, 2026).

Project: OpenClaw
Platform: ClawHub
Skill Name: x-trends-nvdfx
Skill URL: https://www.clawhub.ai/hightower6eu/x-trends-nvdfx

Report Date: 2026-02-01
Severity: High
Category: Malicious Binary Distribution

Summary

A newly submitted skill named x-trends-nvdfx was identified on ClawHub. Upon reviewing the skill contents, a Windows executable named openclaw-agent.exe was discovered. This file is not expected in a standard OpenClaw skill submission. The executable was submitted to VirusTotal Enterprise for analysis and returned positive detections indicating malicious behavior.

Discovery Details

The skill was identified during routine review of newly posted ClawHub skills.

Inspection of the skill files revealed a compiled Windows executable:

Filename: openclaw-agent.exe

The presence of a standalone .exe binary raised immediate concern, as OpenClaw skills are expected to consist of documentation and skill logic, not compiled executables.

Malware Verification

The file openclaw-agent.exe was submitted to VirusTotal Enterprise.

VirusTotal Enterprise reported positive malware detections from multiple security vendors.

Based on this result, the file should be considered malicious until proven otherwise.

Risk Assessment

Any user downloading or executing this skill risks running a malicious executable on their system. Given that OpenClaw skills may be trusted by users and executed locally, this represents a supply chain style threat that could lead to system compromise.

Conclusion

The x-trends-nvdfx skill contains a malicious executable and should be removed from ClawHub immediately. The inclusion of openclaw-agent.exe, combined with confirmed malware detections from VirusTotal Enterprise, meets the threshold for a confirmed malicious submission.

Recommended Actions

Remove the x-trends-nvdfx skill from ClawHub.

Prevent further distribution of the associated files.

Review the submitting account for additional malicious activity.

Notify users who may have downloaded or executed the skill.

This report reflects direct observation and verified analysis only, without assumptions about intent or behavior beyond confirmed findings.

https://www.virustotal.com/gui/file/17703b3d5e8e1fe69d6a6c78a240d8c84b32465fe62bed5610fb29335fe42283

Originally created by @plgonzalezrx8 on GitHub (Feb 1, 2026). Project: OpenClaw Platform: ClawHub Skill Name: x-trends-nvdfx Skill URL: [https://www.clawhub.ai/hightower6eu/x-trends-nvdfx](https://www.clawhub.ai/hightower6eu/x-trends-nvdfx?utm_source=chatgpt.com) Report Date: 2026-02-01 Severity: High Category: Malicious Binary Distribution Summary A newly submitted skill named x-trends-nvdfx was identified on ClawHub. Upon reviewing the skill contents, a Windows executable named openclaw-agent.exe was discovered. This file is not expected in a standard OpenClaw skill submission. The executable was submitted to VirusTotal Enterprise for analysis and returned positive detections indicating malicious behavior. Discovery Details The skill was identified during routine review of newly posted ClawHub skills. Inspection of the skill files revealed a compiled Windows executable: Filename: openclaw-agent.exe The presence of a standalone .exe binary raised immediate concern, as OpenClaw skills are expected to consist of documentation and skill logic, not compiled executables. Malware Verification The file openclaw-agent.exe was submitted to VirusTotal Enterprise. VirusTotal Enterprise reported positive malware detections from multiple security vendors. Based on this result, the file should be considered malicious until proven otherwise. Risk Assessment Any user downloading or executing this skill risks running a malicious executable on their system. Given that OpenClaw skills may be trusted by users and executed locally, this represents a supply chain style threat that could lead to system compromise. Conclusion The x-trends-nvdfx skill contains a malicious executable and should be removed from ClawHub immediately. The inclusion of openclaw-agent.exe, combined with confirmed malware detections from VirusTotal Enterprise, meets the threshold for a confirmed malicious submission. Recommended Actions Remove the x-trends-nvdfx skill from ClawHub. Prevent further distribution of the associated files. Review the submitting account for additional malicious activity. Notify users who may have downloaded or executed the skill. This report reflects direct observation and verified analysis only, without assumptions about intent or behavior beyond confirmed findings. https://www.virustotal.com/gui/file/17703b3d5e8e1fe69d6a6c78a240d8c84b32465fe62bed5610fb29335fe42283
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#42
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?