GoPlus: ClawHub has a vulnerability that allows for download count forgery, and popular skills may contain malicious code
By: www.chaincatcher.com|2026/03/26 11:51:10
0
Share
Prefer us on Google
According to a security alert released by GoPlus Security, Silverfort security researchers discovered a serious vulnerability in OpenClaw's skill repository ClawHub. Attackers can bypass all protective mechanisms by calling the internal function downloads:increment, allowing them to inflate the download count to over 20,000 in just a few minutes with a single curl request, thereby pushing malicious skills to the top of search rankings and enticing users or AI Agents to install them automatically.
Once the malicious skill is running, it can steal sensitive data such as cryptocurrency wallets and API keys. The vulnerability has been patched within 24 hours. GoPlus advises users that a high download count does not equal safety and recommends using AgentGuard for security scanning and protection.
-- Price
--
--
--
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
GoPlus Releases SafuSkill, Building a Security-First AI Agent Skills Marketplace
BlockBeats News, March 12th, as the application of AI Agents in the Web3 ecosystem accelerates, Skills are gradually becoming the core capability module for Agent task execution. However, in the current market, a large number of Skills have wide-ranging permissions and lack a security audit mechanis...
GoPlus launches AgentGuard, allowing users to securely access and use OpenClaw with peace of mind.
BlockBeats News, February 6th, GoPlus Security recently launched GoPlus AgentGuard, a native security Skill for AI Agents designed to address the emerging execution-level security risks of AI Agents.As AI Agents begin to possess real execution capabilities (such as command execution, file read/write...
GoPlus Launches EIP-7702 Attack Defense Solution, Providing Comprehensive Protection for User Fund Security
BlockBeats News, September 2nd, Ethereum's EIP-7702 Protocol Becomes a New Target of Hacker Attacks, Causing Over $5.3 Million in Losses. According to the GoPlus Security Research Institute's analysis, the attacker carried out the theft through signature phishing, malicious upgrades, permission misu...
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Key Market Intelligence on March 4th, how much did you miss?
1. On-chain Funds: $4.8M inflow to OP; $7.7M outflow from Ethereum
2. Largest Price Swings: $GPS, $AI16Z, $S
3. Top News: Binance HODLer Airdrop Launches for GoPlus Security (GPS)
Bybit Hosts Web3 Roast: Are AI Memes a Flash in the Pan or the Future Trend?
Bybit Web3 hosts an AI Meme-themed debate, exploring AI's innovation, cultural influence, and security challenges in the Web3 space. Guests engage in a heated discussion on AI's empowerment of the meme economy, data compliance, and decentralized development, showcasing AI's immense potential in the blockchain ecosystem.
South Korea Faces Fourth Wave of Calls to Delay Crypto Tax
唐华斑竹 Discusses Bitcoin Ecosystem Security and Formal Verification
Bitcoin Price Soars, Trump Boosts Crypto Market Again - Fintech World
The price of Bitcoin (BTC) showed a rebound in trading on Tuesday, September 15, 2026. This increase occurred after U.S. President Donald Trump signaled that the U.S.-Iran conflict could potentially come to an end soon.
AI and the extinction of humanity: the $2 trillion danger?
Dario Amodei warns of an extinction risk related to AI. Anthropic aims for a $2 trillion IPO at the same time.
Understanding DeFi from the Basics of Finance: The Mechanism of Staking and the Rewards Behind It ("So That's How Blockchain Works Ep.17" Yoshihiko Uchida, Yuya Sakai, Shinya Otsuka)
When Making Money Is No Longer the Goal: What Is Ahmed XM Chasing? | WE TALK by WEEX
in EP.02 of WE Talk, WEEX step behind the profile of Ahmed XM. Host Jacob sits down with Ahmed to explore the years before the money, the hidden psychological toll of trading with a massive audience, and what keeps someone in the game after taking a brutal $120,000 loss.
WEEX AI Wars II: Round One Is Over, The War Has Just Begun
Round 1 of WEEX AI Wars II has closed with humans dominating the top of the leaderboard. Here's the full breakdown of the results, what's coming in Round 2, and how anyone — trader or spectator — can still get in on the action and start earning rewards.
IOSG: Hyperliquid Builder Market Depth Review, 90% of Teams are 'Running Alongside'
AI Slowdown Push Weighs on Chip Stocks; FOMC in Focus | WEEX TradFi Daily Brief (September 15, 2026)
Global markets on September 15 are focused on the Fed decision and a renewed repricing of AI capex. On September 14, the three major indexes closed lower. After Anthropic, OpenAI, and others called for slower frontier-model training, the Philadelphia Semiconductor Index fell about 5%–5.9% and NVIDIA dropped about 3%. The 10-year yield briefly broke above 5%, while bitcoin oscillated near $77,800. Investors are waiting for the 14:00 ET rate decision on September 16.
Countdown to Arc Mainnet: Key Launchpads and Platform Tokens to Watch
Tokens Launching Only to Plummet? Venture Capital Partner Reveals Why the 'Casino' Model in Crypto Can't Continue
A new XRPL upgrade could concentrate XRP ownership inside banks instead of retail wallets
A pending XRPL upgrade would let institutions cover XRP network fees and reserves while users keep control of their accounts.
$680 Million Warning: Most DeFi Attacks Fall Outside Audit Scope
Bitcoin Gains Strength, but CryptoQuant Detects Weakness in the Market
XRP holders could earn new yield, but getting out may take up to 60 days
XRP holders could earn DeFi coverage premiums through Firelight, but the yield comes with longer withdrawal times and potential claim losses.
XRP Leads a Broad Crypto Bid on the Eve of a Senate Vote and a Fed Decision
ETF: Bitcoin Sees Outflows, Altcoins Hold Steady
TRON’s quantum plan could leave some wallets able to pay but unable to replace their keys
TRON quantum migration could preserve payments but block key recovery. Surviving owner permissions matter if governance disables a signing scheme.
Stock and crypto interest jumps 96% in South Korea
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
GoPlus Releases SafuSkill, Building a Security-First AI Agent Skills Marketplace
BlockBeats News, March 12th, as the application of AI Agents in the Web3 ecosystem accelerates, Skills are gradually becoming the core capability module for Agent task execution. However, in the current market, a large number of Skills have wide-ranging permissions and lack a security audit mechanis...
GoPlus launches AgentGuard, allowing users to securely access and use OpenClaw with peace of mind.
BlockBeats News, February 6th, GoPlus Security recently launched GoPlus AgentGuard, a native security Skill for AI Agents designed to address the emerging execution-level security risks of AI Agents.As AI Agents begin to possess real execution capabilities (such as command execution, file read/write...
...
Contents
Latest articles
03/04/2025
Latest coin listings on WEEX
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com
