CEORater

• Analyzed: May 12, 2026, 3:14 AM
• Findings: 1
• Version: 1.0.9
• Hash: f5197cba21e37be7c50bee8ee55961b8f6e44d79543f2f78a037c08a46090122
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle for CEORater is benign. The `SKILL.md` clearly defines the API interaction and uses `disable-model-invocation: true`, which is a good security practice. The `scripts/ceorater.sh` helper script, which is the only executable component, demonstrates robust input sanitization and validation using `sanitize()` and `urlencode()` functions, along with regex and numeric checks, effectively preventing shell injection vulnerabilities. All network communication is directed to the legitimate `api.ceorater.com` domain, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.