Dievio Lead Search API

• Analyzed: May 11, 2026, 4:54 AM
• Findings: 1
• Version: 1.0.3
• Hash: 2e93fbcb7fcf243fd9484a7cee1e61c19ba760aed186f1cff632fc25ea17e9d9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a Local File Inclusion (LFI) vulnerability in `scripts/dievio_api.py`. The `_load_json_file` function, used by `cmd_search` and `cmd_linkedin_lookup` via the `--body-file` argument, allows reading arbitrary JSON files from the local filesystem. While the script's core functionality is legitimate API interaction, an attacker could exploit this vulnerability through prompt injection against the OpenClaw agent to read sensitive JSON configuration or credential files, potentially exposing their contents if the agent is instructed to output the full response (especially with `--raw-output`). There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints or backdoor installation.