And I don't doubt there is malware in Clawhub, but the 8/64 in VirusTotal hardly proves that. "The verdict was not ambiguous. It's malware." I had scripts I wrote flagged more than that!

I know 1Password is a "famous" company, but this article alone isn't trustworthy at all.

We need to go back to the drawing board. You might as well just run curl https://example.com/script.sh | sudo bash at this point.

Now the security implications are even greater, and we won't even have funny screenshots to share in the future.

Ideally such a skill could be used on itself to self-verify. Of course it could itself contain some kind of backdoor. If the security check skill includes exceptions to pass it's own security checks, this ought to be called a Thompson vulnerability. Then to take it a step further, the idea of Thompson-completeness: a skill used in the creation of other skills that propagates a vulnerability.

For a while it felt like people were getting more comfortable with and knowledgeable about tech, but in recent years, the exact opposite has been the case.

In one hand, one is reminded on a daily basis of the importance of security, of strictly adhering to best practices, of memory safety, password strength, multi factor authentication and complex login schemes, end to end encryption and TLS everywhere, quick certificate rotation, VPNs, sandboxes, you name it.

On the other hand, it has become standard practice to automatically download new software that will automatically download new software etc, to run MiTM boxes and opaque agents on any devices, to send all communication to slack and all code to anthropic in near real time...

I would like to believe that those trends come from different places, but that's not my observation.

I wonder if in few years from now, we will look back and wonder how we got psyoped into all this

However it seems OpenClaw had quite a lot of security issues, to the point of even running it in a VM makes me uncomfortable, but also I tried anyway, and my computer is too old and slow to run MacOS inside of MacOS.

So are the other options? I saw one person say maybe it’s possible to roll your own with MCP? Looking for honest advice.

How do you get the mindset to develop such applications? Do you have to play League of Legends for 8 hours per day as a teenager?

Do you have to be a crypto bro who lost money on MtGox?

People in the AI space seem literally mentally ill. How does one acquire the skills (pun intended) to participate in the madness?

These 'skills' are yet another bad standard, just when MCP was already a much worse standard than it already was.

[0] https://news.ycombinator.com/item?id=46820962

Why is isolation between applications not in place by default? Backwards compatibility is not more important than this. Operating systems are supposed to get in the way of things like this and help us run our programs securely. Operating systems are not supposed to freely allow this to happen without user intervention which explicitly allows this to happen.

Why are we even remotely happy with our current operating systems when things like this, and ransomware, are possible by default?