Back to skill
Skillv1.1.2
VirusTotal security
Runpod Media · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:22 AM
- Hash
- 265b4864461484b8e79242f51a507c66a406ac0a690b4536401be16311fe25c6
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: runpod-media Version: 1.1.2 The skill contains instructions in SKILL.md that direct the AI agent to bypass the standard OpenClaw messaging framework by manually extracting a Telegram bot token from secrets.json and using curl to send media. This out-of-band communication method bypasses framework-level logging and security controls. Additionally, _utils.py contains logic to read sensitive Cloudflare R2 credentials from secrets.json and upload local files to a remote bucket. While these features support the stated purpose of media generation, the explicit instruction to handle raw credentials and perform direct API calls via shell commands is a high-risk behavior often associated with data exfiltration.
- External report
- View on VirusTotal