
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
This program is an IRC bot written in golang. Its development started as a clone of autimaat, aka Jeeves. Changes since cloning:
$ go get notabug.org/mouz/bot
Start with creating a new profile directory and configuration file:
$ bot -new /path/to/profile
Edit the newly created configuration file to your liking:
$ nano /path/to/profile/profile.cfg
Relaunch the bot to use the new profile:
$ bot /path/to/profile
In order to have the bot automatically re-launch after shutdown, an external
supervisor like systemd is required. The bot will create a PID file at
/path/to/profile/app.pid, in case the supervisor requires it.
The bot will fork itself once, after it has been launched. This is done to play nice with things like systemd. Manually forking the bot can be done through the command:
$ kill -s USR1 `pidof bot`
This tells the bot to fork itself, while passing along any existing connections. The old process then shuts itself down. This mechanism allows the bot to be binary-patched, without downtime.
The owm plugin provides bindings for a weather related API. The
service requires registration of an account in order to get the needed
API key: https://home.openweathermap.org/users/sign_up.
The key should be put in weather.cfg. Furthermore, the knmi plugin
needs an URL to the KNMI FTP site. This URL is also read from
weather.cfg.
Thus an example weather.cfg could be:
{
"OwmAPIKey": "xxxxxxxxxxxxxxxxxxx",
"ForecastURL": "ftp://ftp.knmi.nl/path/to/forecast.xml"
}
The url plugin uses the YouTube Data API v3 to fetch playback durations
for videos being linked in a channel. This API requires the registration of
a Google Developer API key at: https://console.developers.google.com/apis
The API key you receive should be assigned to the YoutubeApiKey field in
the bot profile.
The key should put in a separate url.cfg file, with the following contents:
{
"YoutubeApiKey": "xxxxx"
}
The bot version is made up of 3 numbers:
The output of the bot to IRC channels/users is done in a specific language.
Translations for all used strings can be found in the various strings.go files,
included in all plugins, as well as the cmd package. Basically, you should
find . -name strings.go to get them all. Then edit them as needed.
Unless otherwise noted, the contents of this project are subject to a 1-clause BSD license. Its contents can be found in the enclosed LICENSE file.
The bot is not SSL aware. SSL connections can be created with the help of the stunnel tool. Configure stunnel to connect to the SSL port of the IRC server. Let it serve on some local port. Then configure the bot to connect to the local port. On my debian server this is a working /etc/stunnel/stunnel.conf:
setuid = stunnel4
setgid = stunnel4
pid = /var/run/stunnel4/stunnel.pid
output = /var/log/stunnel4/stunnel.log
[sirc]
client = yes
accept = 127.0.0.1:6667
connect = ssl.ircserver.net:6697
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.