Post and manage errands for human workers

• Analyzed: May 15, 2026, 4:04 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2734e8b73855991c4029d66a4f705dea4ebec1e11c525f18882c520c140ad4d4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for ErrandAI appears benign. All code (`errandai.skill.js`) and documentation (`SKILL.md`, `README.md`, `manifest.json`) align with the stated purpose of integrating with the ErrandAI platform to post and manage errands. The skill correctly handles API keys via environment variables or configuration, uses HTTPS for all external communication to `https://api.errand.be`, and declares necessary `network` and `api` permissions. There is no evidence of data exfiltration, malicious execution (e.g., `eval`, `exec`, `child_process`), persistence mechanisms, or prompt injection attempts designed to subvert the AI agent's behavior. Potential vulnerabilities like ReDoS in regex parsing or downstream API injection are not indicative of malicious intent within this skill.