Riddle

• Analyzed: May 12, 2026, 3:33 AM
• Findings: 1
• Version: 1.1.0
• Hash: 7c1b13fd74f3d3e4d8896adbe3562b62547b1dc2a94052c4bf3d87284c081c58
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as benign. The `SKILL.md` provides clear instructions for installing and configuring a browser automation plugin, including setting an API key and modifying the OpenClaw configuration file (`~/.openclaw/openclaw.json`) using `jq` to add the plugin to an allow list. While direct file modification and external plugin installation (`@riddledc/openclaw-riddledc`) are present, they are explicitly explained as necessary for the plugin's functionality. Crucially, the `SKILL.md` includes a 'Trust & Security' section that declares strict boundaries for the plugin, such as network access limited to `api.riddledc.com`, filesystem writes restricted to `~/.openclaw/workspace/riddle/`, and zero access to agent context or other secrets. There is no evidence of prompt injection attempts, data exfiltration instructions, or other malicious intent within the provided files.