Native Typeform

• Analyzed: May 11, 2026, 4:34 AM
• Findings: 1
• Version: 1.0.1
• Hash: 7426a6aed5101a8ace8b8a6293e5052abad572476a2d78c05af59ded8010830a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill bundle for Typeform is benign. The `SKILL.md` and `README.md` clearly describe its purpose to interact with the official Typeform API. The `scripts/typeform.py` script uses standard Python libraries (`urllib.request`, `os`, `argparse`) to fetch data from `https://api.typeform.com` using a `TYPEFORM_TOKEN` from environment variables. There is no evidence of data exfiltration to unauthorized endpoints, malicious command execution, persistence mechanisms, or prompt injection attempts against the AI agent. All operations are confined to reading Typeform data as described.