GoPlus: ClawHub has a vulnerability that allows for download count forgery, and popular skills may contain malicious code
By: www.chaincatcher.com|03/26/2026 11:51:10
0
Share
Prefer us on Google
According to a security alert released by GoPlus Security, Silverfort security researchers discovered a serious vulnerability in OpenClaw's skill repository ClawHub. Attackers can bypass all protective mechanisms by calling the internal function downloads:increment, allowing them to inflate the download count to over 20,000 in just a few minutes with a single curl request, thereby pushing malicious skills to the top of search rankings and enticing users or AI Agents to install them automatically.
Once the malicious skill is running, it can steal sensitive data such as cryptocurrency wallets and API keys. The vulnerability has been patched within 24 hours. GoPlus advises users that a high download count does not equal safety and recommends using AgentGuard for security scanning and protection.
-- Price
--
--
--
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Solana's Shanghai Entity Established in June with No Capital Ties to Main Body; Developer Event Postponed Due to Over-registration
Why You Might Be Losing Money on Papertrade?
Marqeta and Coinbase Expand Partnership to Launch Stablecoin Payment Cards
Pacific Meta Expands Partnership with Chainlink for Institutional Tokenization
Zcash’s planned Sprout freeze would leave private keys unable to move funds
Zcash’s proposed NU7 upgrade would end Sprout spending even with intact keys. Mainnet timing awaits a decision planned for October 20.
Bitcoin or Dollar Returns: Same Strategy, Opposite Results
Bitcoin or dollar returns: in 2022, the same 5% strategy ended at -62% or +5% depending on the currency of account. What the saver needs to know.
Stablecoin Payments Surge 45% Despite No New Supply
Bitcoin: AI Crash or Superabundance, Bitwise Sees Only One Winner
For Matt Hougan, Chief Investment Officer at Bitwise, Bitcoin emerges as a winner from both an AI crash and a productivity boom. Three macro scenarios.
Crypto doesn’t need your party to win, just its candidates
Fairshake's bipartisan election spending shows how they back both parties' candidates, and why election wins don't guarantee legislation.
BitTorrent Ushers in Next-Gen Web3 Infrastructure with Strategic Rebrand and Inaugural BTT Burn
Bitcoin’s Quantum Transition Won’t Stop at Bitcoin
Michael Saylor hints at more Bitcoin buys as Strategy holds 848,250 BTC
JUST Completes 5th JST Buyback & Burn: Over 170M Tokens (~$23.53M) Burned Ahead of Major Deflationary Upgrade
JUST completes its fifth JST buyback and burn, removing over 170 million tokens worth $23.53 million as it prepares to upgrade the revenue-funded program.
AI Model Claude Discovers 25-Year-Old US Cryptography Secret; Satoshi's Choice Under Scrutiny Again
Crypto: Ethereum Prepares for a Historic Increase in Gas Limit with Glamsterdam
Global Liquidity: Could the Japanese Oil Crisis Collapse US Treasuries?
BIS: Bank rate hikes cut stablecoin growth by 3 points
CryptoQuant CEO sees $30,000 Bitcoin floor even if ETFs and treasury firms exit
CryptoQuant CEO Ki Young Ju argues Bitcoin could find support near $30,000 even after a hypothetical exit by spot ETFs and corporate treasuries.
ZKsync vs Starknet: Which ZK Rollup is Superior?
ZKsync vs Starknet: Starknet recorded 7.31 times the number of transactions over 30 days compared to ZKsync Era, while its collateral value was only 1.96 times higher. This article organizes objective metrics comparing proof methods, gas tokens, L2BEAT stages, and supply differences.
Why does Circle keep only 7 cents for every dollar it earns?
Bitcoin: Arthur Hayes Sees an Opportunity in the AI Bubble
Chip Bets Lost $52 Million in 10 Minutes with Wall Street Closed
Bitget restricts users in Russia and Belarus under new rules
Raydium Quarterly Report Analysis: Trading Fees Triple, Q4 Growth Sustainability in Doubt
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
...
Contents
Latest articles
More
Latest coin listings on WEEX
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com
