Back to skill
Skillv1.0.1
VirusTotal security
Beaver Habit Tracker · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 29, 2026, 4:15 AM
- Hash
- 56dc2c80923527c5eadc643f01aa22748ceff0b6243fb17b5e36b889787d2ee0
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: beaverhabits Version: 1.0.1 The skill is designed to interact with the Beaver Habit Tracker API using `curl` and sends the `BEAVERHABITS_API_KEY` in an Authorization header. The `SERVER_URL` is configurable via an environment variable (SKILL.md), allowing the API key to be sent to an arbitrary, user-defined endpoint instead of the default `https://beaverhabits.com`. While this feature is presented for legitimate self-hosting, it represents a risky capability that could be exploited for API key exfiltration if the `SERVER_URL` is maliciously controlled or injected, even though the skill itself does not demonstrate explicit malicious intent.
- External report
- View on VirusTotal