ClawHub Quarantine Installer

• Analyzed: May 12, 2026, 4:27 AM
• Findings: 1
• Version: 1.0.3
• Hash: dd0ea8995a8e55f5610c5d734dbae0cb06a5cf45c0606a744d9e9e49fae1341f
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is designed to install and audit other OpenClaw skills in a quarantined environment. While its stated purpose is security analysis, it performs a high-risk operation by using `npx clawhub install --force` (as seen in `scripts/install_and_audit.sh` and described in `SKILL.md`) to download and execute arbitrary remote code from the `npm` registry. Although the `SKILL.md` explicitly warns the user about this risk and advises running in an isolated environment, the inherent action of downloading and executing untrusted code, even for analysis, makes it suspicious. There is no evidence of malicious intent within this skill itself (e.g., data exfiltration, backdoors), but its core functionality involves handling potentially malicious external code, which is a significant security concern.