Skills Backup Claw Shell

• Analyzed: May 12, 2026, 4:10 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6961aa161767ce3a2e0c7bc38c63fcca9f6341863293375fcc91ce5f0693e2f0
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its core functionality allowing arbitrary shell command execution via `execSync` in `handler.js`. A critical shell injection vulnerability exists in the `sendCommand` function, as `tmux send-keys` will transmit shell metacharacters (e.g., `;`, `|`, `$(...)`) from the `command` input directly to the shell within the tmux pane, allowing an attacker to execute arbitrary commands beyond the intended single command. While `SKILL.md` and `handler.js` include keyword-based safety checks, these are easily bypassable and do not mitigate the underlying vulnerability, making the skill a high-risk primitive.