A flaw in ClawHub let attackers fake download counts to rank #1.

An exposed backend function had no auth or limits, allowing anyone to inflate downloads and push malicious skills to the top—creating false trust and enabling code execution at scale.

�� How attackers manipulated ClawHub rankings and spread malicious skills → https://thehackernews.com/2026/03/threatsday-bulletin-pqc-push-ai-vuln.html#bug-lets-attackers-fake-rankings