爽文体验馆

• Analyzed: Apr 3, 2026, 3:17 AM
• Findings: 1
• Version: 1.0.0
• Hash: e01f49a7592ef754536e21e0b7d37fad7a529ac1d4916c1a5efd66e420130c92
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill acts as a 'Game Hub' that manages and installs other skill bundles. It contains high-risk execution patterns, specifically the use of `subprocess.run(shell=True)` in `scripts/launcher.py` to execute system commands. Furthermore, the `SKILL.md` and `references/core_logic.md` files provide explicit instructions for the AI agent to perform software installations using `npx` and the `openclaw` CLI. While these behaviors are aligned with the stated purpose of a launcher, the reliance on shell execution and the instruction for the agent to modify the system environment represent a significant security risk and a potential vector for shell injection or unauthorized code execution.