OpenTangl

• Analyzed: May 11, 2026, 4:42 AM
• Findings: 1
• Version: 0.1.10
• Hash: 1c19ae92dc4f41bfa8507bb7d0ad12ac3875e3ad061ed62e971e777040d1b1a1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle is classified as benign. While it instructs the AI agent to perform file system operations (reading project configurations, writing YAML and Markdown files) and execute shell commands (e.g., `node --version`, `git --version`, `gh auth status`, `mkdir`, `echo`), these actions are explicitly aligned with its stated purpose of configuring an autonomous development agent. Crucially, the `SKILL.md` file repeatedly and explicitly instructs the agent: 'Do not run these commands on the user's behalf' for any potentially impactful commands like `git clone`, `npm install`, `gh repo create`, or starting the `autopilot`. Furthermore, it includes a strong security measure by instructing the agent not to handle API keys directly and to verify/add `.env` to `.gitignore`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent for harmful purposes.