Code Quality Analyzer (FightingDao)

• Analyzed: Apr 1, 2026, 1:51 PM
• Findings: 1
• Version: 1.0.0
• Hash: b6289ac70c1f4461da201309c9a561865442d9d6271296bbbbdb827cabffe2e9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle describes a localized code quality analysis system that performs high-risk operations, including executing local JavaScript scripts (e.g., `sync-to-db.js`), performing database deletions and insertions via a local API (http://localhost:3000), and accessing sensitive configuration files like `~/.openclaw/workspace/.email-config.json`. While the detailed instructions and 'Error Case Library' in `SKILL.md` suggest a legitimate internal development tool for a specific user ('zhangdi'), the broad file system access and script execution capabilities represent a significant attack surface without clear evidence of malicious intent.