Ghost Protocol OpenClaw Pay

• Analyzed: May 11, 2026, 6:37 AM
• Findings: 1
• Version: 1.5.0
• Hash: 7edacf33240648bf2117058aa9d1708c6d4327a34c154281791c9fcc64cb7097
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides legitimate-looking tools for Ghost Protocol payments and escrow, but it possesses high-risk capabilities including handling a private key (GHOST_SIGNER_PRIVATE_KEY) for cryptographic signing and making external network requests. Specifically, bin/call-x402.mjs and bin/report-x402-settlement.mjs use the private key to sign transactions and authorization messages sent to ghostprotocol.cc and user-defined merchant endpoints. Furthermore, the documentation in README.md and INSTALL.md references a missing script (scripts/clawhub.ps1) described as applying a 'DNS shim,' which is an unusual and potentially risky networking behavior not fully explained in the provided source code.