GoPlus: ClawHub has a vulnerability that allows for download count forgery, and popular skills may contain malicious code
By: www.chaincatcher.com|2026/03/26 11:51:10
0
Share
Prefer us on Google
According to a security alert released by GoPlus Security, Silverfort security researchers discovered a serious vulnerability in OpenClaw's skill repository ClawHub. Attackers can bypass all protective mechanisms by calling the internal function downloads:increment, allowing them to inflate the download count to over 20,000 in just a few minutes with a single curl request, thereby pushing malicious skills to the top of search rankings and enticing users or AI Agents to install them automatically.
Once the malicious skill is running, it can steal sensitive data such as cryptocurrency wallets and API keys. The vulnerability has been patched within 24 hours. GoPlus advises users that a high download count does not equal safety and recommends using AgentGuard for security scanning and protection.
-- Price
--
--
--
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
ListaDAO Addresses Third-Party Contract Vulnerability Concerns
Key Takeaways GoPlus Security revealed a vulnerability in a contract resembling those of ListaDAO. ListaDAO confirmed that their…
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
GoPlus Releases SafuSkill, Building a Security-First AI Agent Skills Marketplace
BlockBeats News, March 12th, as the application of AI Agents in the Web3 ecosystem accelerates, Skills are gradually becoming the core capability module for Agent task execution. However, in the current market, a large number of Skills have wide-ranging permissions and lack a security audit mechanis...
GoPlus launches AgentGuard, allowing users to securely access and use OpenClaw with peace of mind.
BlockBeats News, February 6th, GoPlus Security recently launched GoPlus AgentGuard, a native security Skill for AI Agents designed to address the emerging execution-level security risks of AI Agents.As AI Agents begin to possess real execution capabilities (such as command execution, file read/write...
GoPlus Launches EIP-7702 Attack Defense Solution, Providing Comprehensive Protection for User Fund Security
BlockBeats News, September 2nd, Ethereum's EIP-7702 Protocol Becomes a New Target of Hacker Attacks, Causing Over $5.3 Million in Losses. According to the GoPlus Security Research Institute's analysis, the attacker carried out the theft through signature phishing, malicious upgrades, permission misu...
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Key Market Intelligence on March 4th, how much did you miss?
1. On-chain Funds: $4.8M inflow to OP; $7.7M outflow from Ethereum
2. Largest Price Swings: $GPS, $AI16Z, $S
3. Top News: Binance HODLer Airdrop Launches for GoPlus Security (GPS)
Bybit Hosts Web3 Roast: Are AI Memes a Flash in the Pan or the Future Trend?
Bybit Web3 hosts an AI Meme-themed debate, exploring AI's innovation, cultural influence, and security challenges in the Web3 space. Guests engage in a heated discussion on AI's empowerment of the meme economy, data compliance, and decentralized development, showcasing AI's immense potential in the blockchain ecosystem.
How Cryptocurrency Owners Lose Fortunes Due to One Mistake in the Blockchain
Cryptocurrency owners lose fortunes not only after hacks: sometimes a wrong swap route, an error in the address, choosing the wrong network, or giving unnecessary permissions to a smart contract is enough for investments worth millions of US dollars to practically disappear after a single signature....
Why 90% of your DeFi trades are quietly being routed back to Wall Street market makers
DeFi tried to replace professional market makers with public AMMs. Now propAMMs are winning orders as tokenized Wall Street moves onchain.
Cryptocurrency Transparency Bill Hangs Between Deal and Failure in the U.S. Senate
The cryptocurrency transparency bill has become a political test of endurance for the crypto market: the industry is awaiting a vote on September 15, but there is still no certainty in Washington about whether it will take place, be postponed, or appear in another legislative form. Cryptocurrency ha...
$19 Billion USDT Inflow: Expansion of Illegal Guarantee Networks in Southeast Asia
From January 2021 to April 2026, over $19 billion USDT has been analyzed to have flowed into illegal cryptocurrency trading guarantee platforms in Southeast Asia. These platforms facilitated transactions related to gambling, money laundering, fraud, and human trafficking.
Trump's Envoy, Crypto Shareholder: The Double Game of Steve Witkoff
Steve Witkoff, Trump's envoy, reports $107 million in 2025 income via his holding linked to World Liberty Financial, tripling from the previous year.
Crypto wallet creators now have just 24 hours to alert regulators when flaws are exploited
The EU Cyber Resilience Act gives in-scope wallet makers 24 hours to flag exploited flaws or severe incidents, with fuller reports due within 72 hours.
ETF: Ether Captures $216 Million, Bitcoin Funds Decline Again
Base tokenized stock volume reaches $100 million
Weekly: Trump's $5000 Promise, OpenAI's Millennium Challenge, Biden's Meme Coin Crash, and Changes in Ethereum Transactions
Uniswap extends DEX lead as volume passes $70 billion
Kazakhstan Launches KZTg Tenge Stablecoin on Telegram
Kazakhstan has introduced its first tenge stablecoin for Telegram: KZTg is pegged to the national currency at a one-to-one ratio, marking the first legal format of the Kazakh tenge in the blockchain infrastructure of the messenger. KZTg is the first stablecoin in tenge available to Telegram users. E...
Bitcoin: Goldman Sachs Changes Its View on Fed Rates
唐华斑竹: Tron Inc. Included in Russell Index, Institutional Holdings Increase
AI Agent Payments: How Far Has Korea Come?
In an era where AI agents autonomously solve problems and make payments for API costs using dollar stablecoins without human intervention. In the global market, AI already owns wallets, and the infrastructure for 'Machine-to-Machine' transactions that settle micro-payments in real-time is being buil...
![[Column] Can Staked Virtual Assets Be Recovered If the Business Goes Bankrupt?](/public-static/30_f8d737795f.png?format=avif)
[Column] Can Staked Virtual Assets Be Recovered If the Business Goes Bankrupt?
XRP as Financial Infrastructure Investment: Opportunities and Risks Identified by 21Shares
Why the Price of Bitcoin Should Not Be Reduced to a Single Forecast Number
The price of Bitcoin is often presented as a simple target: Bitcoin will rise to a certain level, Bitcoin will reach a new high, the BTC/USD pair will show the desired level by a specific date. But the market is more complex: cryptocurrency depends on liquidity, interest rates, inflation, investor d...
45 Cryptocurrency Wallets in the App Store Put Users' Funds at Risk
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
ListaDAO Addresses Third-Party Contract Vulnerability Concerns
Key Takeaways GoPlus Security revealed a vulnerability in a contract resembling those of ListaDAO. ListaDAO confirmed that their…
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
GoPlus Releases SafuSkill, Building a Security-First AI Agent Skills Marketplace
BlockBeats News, March 12th, as the application of AI Agents in the Web3 ecosystem accelerates, Skills are gradually becoming the core capability module for Agent task execution. However, in the current market, a large number of Skills have wide-ranging permissions and lack a security audit mechanis...
...
Contents
Latest articles
05/21/2026
03/04/2025
Latest coin listings on WEEX
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com
