Codehooks Backend

• Analyzed: May 12, 2026, 4:23 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8f52a9402e3299330401835aa47c2d1b3e5f5d586ca03162c836cf0e62b3a70e
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to the significant power it grants to the OpenClaw agent, including the ability to deploy arbitrary code to a live server and make outbound network calls to agent-defined URLs. While the skill explicitly warns the user about these capabilities in SKILL.md and README.md, and the code examples (e.g., examples/workflow-automation.js with its `callbackUrl`) are presented as legitimate features for agent notification, these are high-risk behaviors that could be leveraged for malicious purposes if the agent itself is compromised or instructed maliciously. The core functionality of `coho deploy` effectively allows for remote code execution (RCE) on the Codehooks platform, controlled by the agent.