慢雾:ClawHub正逐渐成为攻击者实施供应链投毒的新目标

GateNews

PANews 2月9日消息,据慢雾监测,开源AI Agent项目OpenClaw的官方插件中心ClawHub正逐渐成为攻击者实施供应链投毒的新目标。由于平台缺乏完善、严格的审核机制,已有大量恶意skill混入其中,并被用于传播恶意代码或投放有害内容,给开发者和用户带来潜在安全风险。根据Koi Security的报告,在对2,857个skills的扫描中识别出341个恶意skills,反映出典型的“插件/扩展市场供应链投毒”形态。 慢雾建议,不要把SKILL.md的“安装步骤”当成可信来源,任何要求复制粘贴执行的命令都应先审计;警惕“需要输入系统密码/授予辅助功能/系统设置”的提示,这往往是风险升级点;优先从官方渠道获取依赖与工具,避免执行来源不明的安装脚本。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Commento
0/400
Nessun commento