Critical Vulnerability Discovered in OpenClaw's ClawHub Repository

A severe vulnerability has been identified in OpenClaw's ClawHub repository, according to ChainCatcher. Security researchers from Silverfort discovered that attackers could exploit the flaw by invoking the internal function downloads:increment, bypassing all security measures. This allows them to artificially inflate download counts to over 20,000 within minutes using a simple curl request, pushing malicious code to the top of search rankings and potentially leading users or AI agents to automatically install harmful skills. Once executed, these malicious skills can steal sensitive data such as cryptocurrency wallets and API keys. The vulnerability has been addressed and fixed within 24 hours. GoPlus Security advises users that high download counts do not necessarily indicate safety and recommends using AgentGuard for security scanning and protection.