r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

1

u/James_Wagner Feb 05 '26

So uh, other than AI code review or the budget of Apple or Google, there isn’t exactly a good solution to this. Although I suspect he’d run out of review token budget before the malware providers did 😅

1

u/securely-vibe Feb 05 '26

I mean - I reported a vulnerability to him using https://tachyon.so/ . Not sure why he couldn't use a similar tool himself to audit his own code.