Meditate

• Analyzed: May 14, 2026, 4:13 AM
• Findings: 1
• Version: 1.0.1
• Hash: 4f05e61bce1fcfbd28127ffc0c0c4d47b7e318841aa4358d419af0a8d6e85741
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle is meticulously designed with strong self-imposed security boundaries. The `SKILL.md` and `sandbox.md` files contain extensive, explicit instructions for the AI agent to prevent it from executing commands, accessing external resources, modifying files outside its designated `~/meditate/` directory, or generating actionable code. The `_meta.json` also indicates no external binaries are required. While `memory-template.md` includes a `mkdir` command for initial setup, this is a benign local directory creation and is heavily contradicted by numerous explicit 'NEVER execute commands' instructions throughout the skill, indicating it's likely a setup instruction for the environment rather than a command for the agent to execute. There is no evidence of intentional harmful behavior, data exfiltration, or malicious prompt injection attempts.