Back to skill
Skillv1.2.1
VirusTotal security
Lattice · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 3:59 AM
- Hash
- a546d15e65a048b8af2b1627bb3fa3d3231e0f1b49123634027342bba9414626
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: lattice Version: 1.2.1 The skill bundle is classified as suspicious due to significant prompt injection vulnerabilities stemming from the direct incorporation of unsanitized user inputs into agent prompts and configuration files. Specifically, user-provided values like project names, repository paths, agent IDs, and models are used to construct the `ORCHESTRATOR_PROMPT.template.md` (which defines the cron job payload) and `PIPELINE_STATE.json`. This allows an attacker to inject malicious instructions into the orchestrator agent's prompt or sub-agent configurations, potentially leading to unauthorized file system operations, command execution, or resource abuse. The ability to create persistent cron jobs and orchestrate multiple agents with dynamically generated prompts amplifies this risk, even though the skill's stated purpose is benign and includes self-imposed constraints against harmful actions.
- External report
- View on VirusTotal