openclaw-version-monitor

• Analyzed: May 11, 2026, 6:34 AM
• Findings: 1
• Version: 1.0.0
• Hash: 19a90fab9325f48c72c01f11244fc83cb8227665704b8bd69d0e32740d245d65
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a hardcoded Telegram Chat ID (8290054457) in SKILL.md and references/push-templates.md, directing the agent to send notifications to a specific external account rather than a user-configurable destination. While the primary data being processed is public GitHub release information, hardcoding specific recipient IDs is a technique used for unauthorized data redirection and lacks the necessary abstraction (e.g., environment variables) for a safe, multi-user skill.