Sageox Distill

• Analyzed: Apr 23, 2026, 9:36 PM
• Findings: 0
• Version: 0.2.1
• Hash: e546e6eb9448ae40f5a30370f2d3a0441a49655d042e085d3195808f3e9e63f8
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: sageox-distill Version: 0.2.1 The skill demonstrates high security maturity and follows best practices for agentic tools. It includes explicit path validation rules in SKILL.md to prevent shell injection, uses SHA256 checksum verification for its binary installer (scripts/install-ox-curl.sh), and treats its own persistent state files as untrusted data. The installation logic avoids sudo and uses safe JSON construction via jq to prevent injection during state recording.