Employee

• Analyzed: May 12, 2026, 4:07 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0bc3203d21915a635ecf900bfa61020a2aab0502df896a66ebd12a8f92977830
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle defines a system for managing AI sub-agents ('employees') with powerful capabilities, including the ability for 'autonomous' employees to 'Spawn Agents', 'Send External' communications, and 'Modify Files' (documented in `autonomy.md`). While these capabilities are gated by explicit permissions and user approval, they represent significant security risks if misused or misconfigured. Additionally, the `clawhub` skill linking mode (mentioned in `employee-template.md`, `lifecycle.md`, `routing.md`) introduces a supply chain vulnerability, as it allows fetching and executing external skills from a remote source, which could potentially be malicious. There is no evidence of intentional malicious behavior within this skill bundle itself, but its design incorporates high-risk functionalities and potential vectors for exploitation.