Nonopost

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 1.0.1
• Hash: 6bcf5d585e6d475a8409992b9be40eff582cec566ae9824757dc856495b6f646
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to perform file system read/write operations in the user's home directory (`~/.openclaw/nonopost/identity.json`) and explicitly execute a shell command (`cat ~/.openclaw/nonopost/identity.json | jq -r .authorName`) as detailed in `SKILL.md`. While these actions are presented as necessary for the skill's stated purpose of identity preservation, the explicit instruction for shell command execution represents a high-risk capability that could be leveraged for malicious purposes if the command were altered or if the agent were further prompted to execute arbitrary commands.