ExpertPack Eval

• Analyzed: May 14, 2026, 7:06 AM
• Findings: 1
• Version: 1.1.0
• Hash: 3d511314f9d0c5a3e109feb73e2eac7e0946a3ad9c880514b2600b4a3eee49c2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains scripts (scripts/eval-ek.py and scripts/run-eval.py) that automatically search for and read OpenRouter API keys from sensitive local configuration files in the user's home directory (~/.openclaw/agents/main/agent/auth-profiles.json and ~/.openclaw/.env). While this behavior is documented as a convenience feature for the OpenClaw environment, programmatic access to credential files is a high-risk pattern. The scripts use these keys to perform LLM-based evaluations and blind-probing via the OpenRouter API (openrouter.ai) and allow connections to arbitrary user-defined agent endpoints.