Smooth Browser

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 0.1.0
• Hash: 9c8910d2273c8b8a4ae36c690e3cb237f3aabeb43994198a49201b574241f7bf
• Source: palm
• External report: View on VirusTotal

Findings (1)

OpenClaw Agent Skill The skill bundle is classified as suspicious due to the presence of high-risk capabilities that could be exploited for data exfiltration or unauthorized actions. Specifically, the `smooth upload-file` command in `SKILL.md` allows the agent to upload arbitrary local files (e.g., `/path/to/document.pdf`) to the `smooth.sh` service. While the stated purpose is benign, this capability, combined with the agent's autonomy, creates a significant risk if the agent were to be maliciously prompted to upload sensitive files (e.g., credentials, private keys). Additionally, the `smooth evaluate-js` command allows arbitrary JavaScript execution within the browser, which could be abused.