
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
Lucy is a tool for sharing, coordinating, and automating code in any language. Lucy works by feeding JSON into code templates, producing customized code that compiles and runs.
Lucy is just getting started, but you can keep up with the latest news and learn about what lucy can do here:
http://lucybot.github.io/blog/
Want to get an early peek at everything lucy can do? Join the beta!
You'll need nodejs to run lucy:
https://github.com/joyent/node/wiki/installing-node.js-via-package-manager
sudo npm install -g lucy
lucy adduser
lucy build definition:package config.json
Note: define is currently only open to beta testers. Join the beta for access
lucy define definition.json
Note: publish is currently only open to beta testers. Join the beta for access
lucy publish /path/to/directory/containing/package.json
There are two main components to a lucy module:
Most users will simply run lucy build to generate code from an existing lucy package. However, you can also create your own definitions and packages to share with others. Let's walk through a "hello world" example.
Note that while we're in beta, the define and publish commands won't work unless you're signed up. Feel free to jump ahead to build though!
To download all the files described in this tutorial, enter a new directory and run
lucy build hello-world-starter '{"username": "SOME_UNIQUE_ID"}'
choosing a unique id that won't collide with other hello-world-* definitions.
you can then run
lucy define def.json
lucy publish pkg
lucy build hello-world-YOUR_UNIQUE_ID:js config.json
lucy publish javapkg
lucy build hello-world-YOUR_UNIQUE_ID:java config.json
We start with a definition:
def.json
{
"name": "hello-world",
"description": "A hello world example for lucy",
"sample_input": {
"greeting": "Hello",
"person": "world"
}
}
(you'll need to replace "hello-world" with something unique)
and run:
lucy define def.json
which pushes the definition to lucy's servers.
Now we create a package by starting a new directory 'pkg'
pkg/hello.js
console.log('<%- greeting %> <%- person %>');
pkg/package.json
{
"lucy_def": "hello-world",
"package_name": "js",
"files": [{
"from": "hello.js"
}]
}
and run
lucy publish pkg
which will zip up the directory and upload the resulting tarball.
Now anyone can create a config.json like
config.json
{
"greeting": "Yo",
"person": "lucy"
}
and run
lucy build hello-world:js config.json
which will generate this file in the working directory:
hello.js
console.log("Yo lucy");
package.json
{
"lucy_def": "hello-world",
"package_name": "java",
"files": [{
"from": "Hello.java"
}]
}
Join the beta if you're intersted in giving it a shot!
FAQs
A command line tool for building LucyBot apps
The npm package lucy receives a total of 6 weekly downloads. As such, lucy popularity was classified as not popular.
We found that lucy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.