Scrapbook-Style Illustration Inserter

• Analyzed: May 12, 2026, 4:21 AM
• Findings: 1
• Version: 1.3.0
• Hash: f5cb4973c38dafe0cedd30f46d590015acf21d204ea547ec9bb7a3e9b05e3398
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the potential for shell injection. The `SKILL.md` instructs the OpenClaw agent to execute `python3 scripts/generate.py` with a dynamically generated image description (derived from user input and a system prompt) as an argument. While the instructions show the argument enclosed in quotes, a robust agent implementation is critical to prevent shell injection if the generated description contains shell metacharacters or malformed quotes. The `scripts/generate.py` itself broadly searches for API keys across environment variables and various config/`.env` files, which, while intended for flexibility, could be a concern in a compromised environment. However, there is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or obfuscation within the provided files.