Skill Validator

• Analyzed: May 11, 2026, 7:42 AM
• Findings: 1
• Version: 1.1.0
• Hash: 2cc1e6ef1cf232ef578a92784b05c40cdb2805287b9a5ea4dc98b0ea3f161c65
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is a utility designed to validate other OpenClaw skills, but it contains a significant security risk: it automatically executes arbitrary shell scripts from the target skill's directory (specifically in scripts/validate.sh) to test functionality. While the included SECURITY.md file explicitly acknowledges this Remote Code Execution (RCE) risk and suggests sandboxing or static analysis, the current implementation lacks these protections. This creates a scenario where a user attempting to 'validate' a malicious skill would inadvertently trigger its payload.