Setup & Installation
openclaw skills install @orlyjamie/dont-click-this
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
npx clawhub install dont-click-this
What This Skill Does
A security research proof-of-concept demonstrating stored XSS via SVG files in skill marketplaces. Clicking the included link while logged into ClawdHub shows how a malicious skill can steal session tokens and impersonate users. Part of the 'Eating Lobster Souls' research series by @theonejvo.
Shows the full attack chain end-to-end rather than just describing the vulnerability class in the abstract.
When to use it
- Demonstrating SVG-based XSS attack chains to a security team
- Understanding session hijacking risks in plugin/skill marketplaces
- Security awareness training for platform developers
- Reproducing a stored XSS vulnerability report
- Showing how a single link can lead to full account compromise