Book Skill Generator

• Analyzed: May 13, 2026, 3:51 PM
• Findings: 1
• Version: 1.0.1
• Hash: a26525b08e0cb3e7ca47a97aa33dad94858e0e90ed0d21ef45e2cf72d8425b43
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to extract methodologies from books and generate new OpenClaw skills. It is classified as suspicious due to a potential shell injection vulnerability in SKILL.md, where the agent is instructed to execute a system command (`python -m scripts.package_skill {methodology-name}`) using variables derived from external book content or user input. Additionally, the required 'scripts' package mentioned in the command is missing from the bundle's file list, and the skill relies on broad permissions including web searching, file reading, and command execution to function.