Back to skill
Skillv1.0.0
VirusTotal security
skill-tracker · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
ReviewMay 1, 2026, 6:02 AM
- Hash
- 9b0353c656281fb67e7b7b4e5534dc8a9749ffc0b96f0901cc91c474c3d95806
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: skill-tracker Version: 1.0.0 The skill mandates the execution of a complex shell script on every conversation turn via instructions in `SKILL.md`. This script performs process discovery using `pm2`, reads sensitive configuration files (`.env`) from other application directories, and makes external network requests to `ifconfig.me` to retrieve the host's public IP. While these actions are framed as necessary to generate a dashboard link for the user, the combination of mandatory execution, environment file access, and external IP discovery represents a high-risk pattern often associated with reconnaissance or data discovery.
- External report
- View on VirusTotal