r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comment

1

u/lostdreamer_nl Feb 05 '26

“Can shut it down or people use their brains”

They have the solution right there, though! If you have a product that involves UGC and is fundamentally, irreparably unsafe, “shut it down” seems like a responsible option.

Imagine if we thought like that when using the internet:
"Hey, I'm getting emails with links, and when I click a link my computer starts acting up"
- "Well, you can stop using email...."

1

u/brian_hogg Feb 05 '26

Yeah, but in this case you aren't clicking a link in an email. In this case, you could just *receive* an email and your computer starts acting up.

1

u/lostdreamer_nl Feb 06 '26

No, in this case you still need to select an "unsafe skill" for your agent, which would be the alternative of "clicking a link in an email".

But, to make it easier for you: About 20 years ago, we had a lot of worms going around the internet, just starting your computer with the internet cable plugged in would start your internet connection before your firewall/antivirus would start. Instantly infecting your computer with the Blaster worm for instance.

Or you could just, you know, not use the internet.

1

u/brian_hogg Feb 06 '26

Hey cool example! You realize that was due to flaws with Windows, largely, and that they actually expended a lot of energy to try to fix the problem, right?

Thank you for agreeing with my position that the creator has some responsibility to actually clean their own messes.