Cyber Security News Aggregator
.Cyber Tzar
provide acyber security risk management
platform; including automated penetration tests and risk assesments culminating in a "cyber risk score" out of 1,000, just like a credit score.
First slide label
Some representative placeholder content for the first slide.
Second slide label
Some representative placeholder content for the second slide.
Third slide label
Some representative placeholder content for the third slide.
We scanned 6,500+ ClawHub skills. 36% have security flaws. Built a Free Community run scanner to catch them before they execute
published on 2026-02-27 07:49:22 UTC by /u/kinso1338Content:
The OpenClaw skills ecosystem has a real supply chain problem and most users don't know it.
Skills run with full agent permissions — filesystem, network, shell. A malicious SKILL.md can harvest credentials, establish persistence, or exfiltrate data before you've realized what happened. ClawHub has no enforcement, and the official tooling doesn't scan skill content.
So we built Clawned. It does deep static analysis on SKILL.md files — 60+ patterns covering:
- Obfuscated payloads and base64 encoded commands
- ClickFix social engineering in skill instructions
- Hidden shell execution
- Credential harvesting patterns
- Privilege escalation and filesystem traversal
- Unauthorized permission requests
Full report in under 10 seconds, free, no signup. API available for CI/CD gating.
From what we've scanned so far — video-agent, 4claw, morning-briefing-generator are confirmed threats sitting in the public registry right now.
https://clawned.io | feedback welcome, especially on false positives
[link] [comments]
https://www.reddit.com/r/netsec/comments/1rg0ijo/we_scanned_6500_clawhub_skills_36_have_security/
Published: 2026 02 27 07:49:22
Received: 2026 02 27 07:51:57
Feed: /r/netsec - Information Security News and Discussion
Source: /r/netsec - Information Security News and Discussion
Category: Cyber Security
Topic: Cyber Security
Views: 4
