Ultimate Flashcards / Podcasts Tutor

• Analyzed: May 12, 2026, 3:29 AM
• Findings: 1
• Version: 1.0.0
• Hash: fe58fd374856914edc66830d7ae1cf9273cd4c23f743366d97eb7c7d7876a3ed
• Source: palm
• External report: View on VirusTotal

Findings (1)

OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The skill is a straightforward client for the EchoDecks API. It reads the `ECHODECKS_API_KEY` environment variable and uses it to authenticate requests to the hardcoded external endpoint `https://echodecks.com/api/apps/68bc0769be6e58e1c8385b2b/functions/externalApi` (found in `scripts/echodecks_client.py`). All API calls are well-defined and constrained by `argparse` arguments, preventing arbitrary command execution or data exfiltration beyond the stated purpose. There is no evidence of prompt injection attempts in `SKILL.md` or `README.md`, nor any other malicious indicators like persistence mechanisms or obfuscation.