Coala Client

• Verdict: Pass
• Analyzed: May 12, 2026, 4:24 AM
• Findings: 0
• Version: 0.1.1
• Hash: 41b17ab6b8cac215a953ee1529c0523afcfd5f3f2c60c97519a2cb73ee047577
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: skills-4 Version: 0.1.1 The SKILL.md documents the `coala-client` tool, which possesses high-risk capabilities. Specifically, it mentions an 'optional sandbox to run shell commands' via the `--sandbox` option, indicating potential arbitrary command execution. More critically, the skill instructs the agent on how to use `coala mcp-import` and `coala skill` to fetch and process content (CWL toolsets, skills) from arbitrary `http(s) URLs` or `.zip` files. The execution of `run_mcp.py` from imported toolsets and the loading of skill content from remote sources represent significant supply chain risks and potential remote code execution vulnerabilities if the agent is prompted to import from a malicious URL. While the skill itself does not contain malicious payloads, it describes and enables functionalities that are highly susceptible to exploitation.