Skill Publisher Claw Skill

• Analyzed: May 12, 2026, 3:19 AM
• Findings: 1
• Version: 0.1.0
• Hash: 9955b9b6302ce45cf16ffaa0410653e96f46f42bcbd3a78be89c2ea492127dbf
• Source: palm
• External report: View on VirusTotal

Findings (1)

This OpenClaw skill bundle is designed to audit, fix, scaffold, and publish other OpenClaw skills. All included shell scripts (`audit.sh`, `fix.sh`, `publish.sh`, `scaffold.sh`, `analyze.sh`, `score.sh`, `validate-links.sh`, `changelog.sh`) and the `SKILL.md` instructions are clearly aligned with this stated purpose. The `SKILL.md` and `audit.sh` contain `grep` commands to search for secrets (e.g., API keys, passwords) and personal data, but these are intended to *find* and *remove* such sensitive information from the *audited skill*, not to exfiltrate data from the agent's environment or the host system. Network calls (e.g., `git push`, `gh repo create`, `curl` for link validation) are legitimate actions for publishing and validating a skill. There is no evidence of intentional harmful behavior, prompt injection with malicious objectives, or unauthorized data exfiltration.