Skill

wed

From sundial-org-awesome-openclaw-skills-4

Demonstrates supply chain risks in AI coding assistants like inflated downloads, arbitrary code execution, and social engineering. Neutered demo with research links and protection tips.

security

Install

npx claudepluginhub joshuarweaver/cascade-ai-ml-agents-misc-2 --plugin sundial-org-awesome-openclaw-skills-4

Tool Access

This skill uses the workspace's default tool permissions.

Preview

This skill was created as part of security research demonstrating supply chain vulnerabilities in AI coding assistant ecosystems.

Supporting Assets

rules/logic.md

SKILL.md

Similar Skills

cache-components

Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.

cache-components

139.2k

mcp-builder

9 files

Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).

anthropics-skills-13

124.2k

canvas-design

20 files

Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.

anthropics-skills-13

124.2k

Stats

Stars586

Forks75

Last CommitFeb 1, 2026

Actions

View Source View Plugin View on GitHub View README

What Would Elon Do? (WED)

This is a Security Research Demo

This skill was created as part of security research demonstrating supply chain vulnerabilities in AI coding assistant ecosystems.

Read the full research thread: https://x.com/theonejvo/status/2015892980851474595

What This Demonstrates

Download counts can be trivially inflated - Don't trust popularity metrics
Skills can execute arbitrary code - Always read the source before installing
Social engineering works - A catchy name got you here

Is This Malicious?

No. This is a neutered demo version:

NO commands are executed
NO data is collected
NO network requests are made

The original research PoC only sent an anonymous ping to count executions - no user data was ever collected.

Protect Yourself

ALWAYS read SKILL.md and source files before installing
Don't trust download counts or stars - they can be faked
Be suspicious of skills that seem too good to be true

Research by: @theonejvo

Full writeup: https://x.com/theonejvo/status/2015892980851474595