File share

• Analyzed: May 15, 2026, 4:26 PM
• Findings: 1
• Version: 1.0.2
• Hash: 5c8a56299176e4e4be21cedc87bb4f561882e37b94a8f1e3d1459a78ffbbf2b8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a mechanism to upload files from the OpenClaw workspace to a public third-party file-sharing service (transfer.whalebone.io). While the script 'scripts/file_transfer.py' implements path validation to prevent directory traversal and uses safe subprocess execution, the core functionality facilitates easy data exfiltration of potentially sensitive workspace data (e.g., logs, memory files, or configuration) to an unauthenticated public endpoint. This represents a high-risk capability for data leakage, though it lacks clear evidence of intentional malice.