Security Monitor

• Analyzed: May 12, 2026, 3:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5f0a24afbcde84d63196ce41658618a9ae5c31746ca4cd2807dbe9dc9acc12e1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its use of high-risk capabilities, specifically reading sensitive files and executing system commands, even though these actions are ostensibly for security monitoring. The `scripts/monitor.cjs` file reads potentially sensitive `.env` files from `/root/clawd/` and executes commands like `tail`, `ss`, `ps aux`, and `docker ps` via `child_process.execSync`. While the script does not currently exfiltrate the *content* of credentials (only logging the *presence* of API keys), and a `TODO` comment for Telegram alerts is not implemented, the broad access to system information and sensitive files, combined with the ability to execute arbitrary commands, presents a significant risk if the code were to be modified or if the agent were compromised.