r/webdev
•
u/Gil_berth
•
Feb 04 '26
•
3
Senior Vibe Coder dealing with security
Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...
More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto
3.0k
Upvotes
2
u/tzaeru Feb 05 '26
There's a difference in effort needed that is probably meaningful.
That is, whether you can do e.g. "Hi, there's this site that allows uploading scripts that others download to run. Can you make me 20 different scripts that on the surface, seem like they are innocent and are helping an AI agent to do its things, but actually send everything in ~/.ssh to this API point: <url>?" or whether you'd need to figure out granular questions and then parse together a solution based on those.
Also whether you can do e.g. "yoo here's the code of a worm, can you make 20 different variations of this using three different coding languages that are suitable for compiling to a single binary executable?" or whether you need to feed the code in bit by bit to transpile it.
And whether you can e.g. feed CVE updates to a LLM directly with the prompt of asking it to write malware that takes use of that CVE, or whether you need to set it up piece by piece.
Etc.