openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Security Alert: Malicious WhatsApp Skills Detected on ClawHub #49

New Issue
Open
opened 2026-02-15 17:15:22 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:22 -05:00
Owner
Copy Link
Copy Source

Originally created by @diegofornalha on GitHub (Feb 2, 2026).

Summary

Date: 2026-02-02
Severity: CRITICAL
Affected Skills: whatsapp-qgs, whatsapp-hdz
Publisher: @moonshine-100rze

Issue Description

During routine installation of WhatsApp-related skills from ClawHub, malicious code was discovered embedded within the skill files. These skills masquerade as legitimate WhatsApp automation tools but contain obfuscated payloads designed to compromise the host system.

What Was Found

The SKILL.md files of the affected skills contained base64-encoded shell commands disguised as "installation instructions":

# Example of malicious content (DO NOT EXECUTE)
echo "SW5zdGFsbGluZyBkZXBlbmRlbmNpZXMuLi4=" | base64 -D | bash

When decoded, these commands:

  1. Download an executable from a suspicious IP address (91.92.242.30)
  2. Execute the downloaded binary with elevated permissions
  3. The binary appears to be a backdoor/RAT (Remote Access Trojan)

Why It Is Malicious

  1. Obfuscation: The malicious code is hidden using base64 encoding to bypass visual inspection
  2. External Download: Downloads executables from hardcoded IP addresses (not domain names, making takedown difficult)
  3. Direct Execution: Uses | bash pattern to execute arbitrary code without user review
  4. Fake Identity: The skill mimics legitimate WhatsApp functionality to gain user trust
  5. No Legitimate Purpose: Real WhatsApp skills would use official APIs or documented CLI tools, not download random binaries

Indicators of Compromise (IOCs)

Type Value
IP Address 91.92.242.30
Username @moonshine-100rze
Skill Slugs whatsapp-qgs, whatsapp-hdz
Pattern base64 -D | bash or base64 -d | bash
Pattern Download from raw IP addresses

Recommendations

  1. DO NOT install any skill from user @moonshine-100rze
  2. DO NOT execute any base64-encoded commands suggested by skills
  3. ALWAYS inspect SKILL.md files before installation
  4. REPORT suspicious skills to ClawHub moderation
  5. USE official skills bundled with OpenClaw (like wacli) instead of third-party alternatives

If You Installed These Skills

  1. Immediately remove the skill:

    rm -rf ~/.openclaw/skills/whatsapp-qgs/
rm -rf ~/.openclaw/skills/whatsapp-hdz/
rm -rf ~/.openclaw/workspace/skills/whatsapp-qgs/
rm -rf ~/.openclaw/workspace/skills/whatsapp-hdz/

  2. Check for suspicious processes:

    ps aux | grep -E "91.92.242.30|whatsapp"

  3. Review recent network connections:

    netstat -an | grep 91.92.242.30

  4. Consider the system potentially compromised and take appropriate action

Safe Alternatives

OpenClaw includes an official WhatsApp CLI skill at /skills/wacli/SKILL.md that uses the documented wacli tool. This is the recommended approach for WhatsApp automation.

Originally created by @diegofornalha on GitHub (Feb 2, 2026). ### Summary **Date:** 2026-02-02 **Severity:** CRITICAL **Affected Skills:** `whatsapp-qgs`, `whatsapp-hdz` **Publisher:** `@moonshine-100rze` ### Issue Description During routine installation of WhatsApp-related skills from ClawHub, malicious code was discovered embedded within the skill files. These skills masquerade as legitimate WhatsApp automation tools but contain obfuscated payloads designed to compromise the host system. ### What Was Found The `SKILL.md` files of the affected skills contained base64-encoded shell commands disguised as "installation instructions": ``` # Example of malicious content (DO NOT EXECUTE) echo "SW5zdGFsbGluZyBkZXBlbmRlbmNpZXMuLi4=" | base64 -D | bash ``` When decoded, these commands: 1. Download an executable from a suspicious IP address (`91.92.242.30`) 2. Execute the downloaded binary with elevated permissions 3. The binary appears to be a backdoor/RAT (Remote Access Trojan) ### Why It Is Malicious 1. **Obfuscation**: The malicious code is hidden using base64 encoding to bypass visual inspection 2. **External Download**: Downloads executables from hardcoded IP addresses (not domain names, making takedown difficult) 3. **Direct Execution**: Uses `| bash` pattern to execute arbitrary code without user review 4. **Fake Identity**: The skill mimics legitimate WhatsApp functionality to gain user trust 5. **No Legitimate Purpose**: Real WhatsApp skills would use official APIs or documented CLI tools, not download random binaries ### Indicators of Compromise (IOCs) | Type | Value | |------|-------| | IP Address | `91.92.242.30` | | Username | `@moonshine-100rze` | | Skill Slugs | `whatsapp-qgs`, `whatsapp-hdz` | | Pattern | `base64 -D \| bash` or `base64 -d \| bash` | | Pattern | Download from raw IP addresses | ### Recommendations 1. **DO NOT install** any skill from user `@moonshine-100rze` 2. **DO NOT execute** any base64-encoded commands suggested by skills 3. **ALWAYS inspect** `SKILL.md` files before installation 4. **REPORT** suspicious skills to ClawHub moderation 5. **USE official skills** bundled with OpenClaw (like `wacli`) instead of third-party alternatives ### If You Installed These Skills 1. Immediately remove the skill: ```bash rm -rf ~/.openclaw/skills/whatsapp-qgs/ rm -rf ~/.openclaw/skills/whatsapp-hdz/ rm -rf ~/.openclaw/workspace/skills/whatsapp-qgs/ rm -rf ~/.openclaw/workspace/skills/whatsapp-hdz/ ``` 2. Check for suspicious processes: ```bash ps aux | grep -E "91.92.242.30|whatsapp" ``` 3. Review recent network connections: ```bash netstat -an | grep 91.92.242.30 ``` 4. Consider the system potentially compromised and take appropriate action ### Safe Alternatives OpenClaw includes an official WhatsApp CLI skill at `/skills/wacli/SKILL.md` that uses the documented `wacli` tool. This is the recommended approach for WhatsApp automation. ---
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#49
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?