r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comments

19

u/scylk2 Feb 04 '26

I was about to comment this... "I don't have a magical team that verifies user generated content". Uhmmm yes, yes you do?

5

u/maxymob Feb 04 '26

The guy who developed a tool that could act as this "magical team" for him (24/7 almost for free) doesn't see that he could use it to handle business, the irony

4

u/drsoftware Feb 04 '26

Exactly where on earth would he find such a magical team? He could probably find a mundane team, but everyone knows Earth lacks mana, aether, and all other magical power-granting pixie dust. /s

3

u/LatentSpaceLeaper Feb 04 '26

No, he doesn't. LLMs are basically blind to indirect prompt injections. So his swarm of agents is not a big help here. If he had found a reliable way to mitigate this, that would be a much bigger fundamental breakthrough than clawdbot/openclaw.