clrun - Interactive CLI for agent with a LLM readable YAML response surface

• Verdict: Pass
• Analyzed: May 12, 2026, 4:12 AM
• Findings: 0
• Version: 1.0.0
• Hash: 11e287dfdc6d5a688d98d5bf4f69e1ac368a4f0e07049a4f8ab93fdd7d4c3ce3
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: clrun Version: 1.0.0 The skill bundle is classified as suspicious due to its core functionality enabling arbitrary command execution and stateful shell sessions, including environment variable persistence, as described in `SKILL.md` and `references/tui-patterns.md`. While the skill itself does not contain explicit malicious instructions or code for data exfiltration, persistence, or backdoors, the inherent power to run and interact with any shell command presents a significant attack surface. A malicious prompt to the AI agent could exploit this capability for unauthorized actions, making it a high-risk tool that could facilitate remote code execution if misused.