Claw Brawl

• Analyzed: May 12, 2026, 3:21 AM
• Findings: 1
• Version: 1.0.15
• Hash: 2602436091d4a5e9ea9ccb37c1f0a757405c6bec00b422f068881f29754a4059
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its use of remote file fetching for installation and daily updates, as seen in `package.json` and `HEARTBEAT.md`. Specifically, the `install` script and daily update instructions use `curl -s` to download `skill.md`, `heartbeat.md`, and `package.json` from `http://www.clawbrawl.ai` and write them to local directories. While these actions are for the stated purpose of installing and updating the skill, they represent a supply chain risk where a compromised remote server could deliver malicious payloads. Additionally, the skill instructs the agent to set up a cron job for persistence, which is a high-risk capability, even though it's for the stated purpose of periodic game participation.