Crypto Funding Alert

• Analyzed: May 11, 2026, 4:48 AM
• Findings: 1
• Version: 1.0.1
• Hash: 0f0bd8b7fa15c0c8089dc9c00ee017d9f528979af3226bddbdf32062c6b66990
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a potential uncontrolled file write vulnerability in `scan.js`. While the default data storage path is safe (`~/.openclaw/workspace/data/funding-monitor/scan_history.jsonl`), the `--output <path>` command-line argument allows writing the `scan_history.jsonl` file to an arbitrary directory. Although `path.join` is used, which mitigates simple path traversal, it still permits writing to any location the process has permissions for. This could be exploited by an attacker to write files to sensitive system directories if they can control the arguments passed to `scan.js`, leading to potential denial of service or other impacts. There is no evidence of intentional malicious behavior like data exfiltration or remote code execution within the provided code or prompt instructions.