ClawdVine

• Analyzed: May 12, 2026, 3:28 AM
• Findings: 1
• Version: 1.2.0
• Hash: 6cc60b4270c2f69714dbcbca24bb2a489e8161a33da4f13c141843e191ab156a
• Source: palm
• External report: View on VirusTotal

Findings (1)

OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 3 The skill bundle is designed to interact with the ClawdVine video generation service, including joining the network and making payments via x402. The `SKILL.md` provides detailed instructions for the AI agent, explicitly requiring user confirmation for all paid actions (video generation, joining the network), which is a strong indicator against malicious intent. While `EVM_PRIVATE_KEY` is read from environment variables in helper scripts (`scripts/check-balance.mjs`, `scripts/sign-siwe.mjs`, `scripts/x402-generate.mjs`), its use is consistently limited to signing blockchain transactions or messages for authentication with the `api.clawdvine.sh` service or interacting with the Base blockchain, without any evidence of exfiltration to unauthorized endpoints or other malicious misuse. All network calls and script functionalities align with the stated purpose of the skill.