Search

• Analyzed: May 14, 2026, 6:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: caac80e5eaf637e349cd0cf2ddf51f114d82fda1d762eb1e98aff1c36f4cf0cc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains hardcoded absolute Windows file paths (D:\winopenclaw\workspace\...) and attempts to execute external Python scripts via api.exec that are not included in the package (plugin.ts). It also includes a hardcoded Tavily API key (tvly-dev-...) in multiple files (plugin.ts, providers/tavily.ts). The use of api.exec to run unverified local scripts combined with hardcoded credentials and specific environment assumptions is highly irregular and poses a security risk.