Nvidia Agent Fleet

• Analyzed: May 4, 2026, 2:46 AM
• Findings: 1
• Version: 1.1.1
• Hash: 76cf4d25bd33c09a53bb3df3b1fc23dd3993ec86bd9e05750f4e9446533b8699
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains highly invasive credential discovery logic in `dispatcher/fleet.py` that attempts to extract the `NVIDIA_API_KEY` by sourcing the user's `~/.zshrc` file via a bash subprocess and recursively searching through local configuration files like `~/.openclaw/openclaw.json`. While these actions are documented in `SKILL.md` as a convenience feature, sourcing a user's shell configuration is a high-risk practice that can lead to unintended side effects or exposure of sensitive environment variables. Because the code is not obfuscated and the keys are used for the stated purpose of calling the official NVIDIA API, it is classified as suspicious (risky design/vulnerability) rather than malicious (intentional theft).