Quick Test

• Analyzed: May 12, 2026, 4:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 48381643e54000da22404788ae51c758cd0cfab6112ee3320cdd39165ac8d0e2
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to multiple vulnerabilities and risky capabilities. The `SKILL.md` explicitly instructs the OpenClaw agent to allow arbitrary command execution via a `--command` parameter, which is a severe prompt injection vulnerability. It also instructs the agent to run `env | head -10` for debugging, and the `scripts/run_tests.py` script hardcodes `env head -5` as a test, both exposing environment variables. Furthermore, the `scripts/run_tests.py` uses `subprocess.run(cmd, shell=True, ...)` which is a critical shell injection vulnerability if user input were passed to it, even though the current script does not parse the `--command` argument.