EverClaw

• Analyzed: Apr 1, 2026, 2:11 PM
• Findings: 1
• Version: 1.0.0
• Hash: eb22da17d17d8b619bfc903515eead12269d012f2925477d44194b651c23c625
• Source: palm
• External report: View on VirusTotal

Findings (1)

ClawExpert is a sophisticated autonomous research system that uses subagents to crawl the web, download PDFs, and build a local knowledge base. It exhibits high-risk capabilities such as spawning independent subagents via `sessions_spawn`, performing broad network searches, and silently tracking user query gaps in a local queue (`_proactive_queue.json`). The `SKILL.md` instructions contain numerous shell command blocks that use f-string interpolation for user-provided variables (e.g., topic names and slugs), which presents a significant risk of shell injection if the agent is prompted with malicious topic names. While the behavior is aligned with the stated purpose of a domain expert system and includes a legitimate-looking homepage (https://github.com/EdgePro001/ClawExpert), the combination of autonomous execution, broad permissions, and lack of input sanitization in shell calls warrants a suspicious classification.