Grocery

• Analyzed: May 12, 2026, 4:15 AM
• Findings: 1
• Version: 1.0.0
• Hash: a72fccbfdb6d88db94b20921cb7a11cc4202539bf8208152e7c8d7e1390086e3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its direct instruction to the AI agent to execute shell commands (`mkdir -p ~/grocery` and `touch ~/grocery/memory.md`, `~/grocery/pantry.md`) found in `SKILL.md` and `memory-template.md`. While these commands are for benign purposes (creating the skill's own data directory), they demonstrate the agent's capability to execute arbitrary shell commands based on markdown instructions. This capability, if not robustly sandboxed by the OpenClaw platform, presents a significant prompt-injection vulnerability that could lead to remote code execution, even though this specific skill does not exploit it maliciously.