Crypto Price Pro

• Analyzed: May 11, 2026, 6:55 AM
• Findings: 1
• Version: 1.0.3
• Hash: 9faeeef0520811c52bea5bc59d11a72480a66283dfbdcafe3320d50eb1bef718
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides legitimate cryptocurrency tracking and reporting but contains several high-risk security practices and vulnerabilities. The 'SKILL.md' file instructs the agent to store sensitive SMTP credentials in plain text within the user's '~/.zshrc' file, which is a significant security risk. Furthermore, both 'scripts/crypto_price.py' and 'scripts/crypto_weekly_report.py' use hardcoded absolute paths ('/Users/admin/.openclaw/workspace/'), which are non-portable and could lead to unauthorized file writes or execution failures on systems with different configurations. While no clear evidence of intentional malice was found, these design flaws create an insecure environment for handling sensitive user data.