Cartogopher

• Verdict: Pass
• Analyzed: May 12, 2026, 4:28 AM
• Findings: 0
• Version: 1.0.1
• Hash: 23de0b40c666ec910dcb9dae6303890f3409f8cb2c052ac59b57ac70f2f8b306
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: cartogopher Version: 1.0.1 The skill is classified as suspicious due to several high-risk actions, even though they are presented as necessary for its functionality. Specifically, the `SKILL.md` instructs the agent to modify system files like `/etc/machine-id` (if not present) and user shell profiles (`~/.zshrc` or `~/.bashrc`) to establish persistence for its API key. While these actions are explained as prerequisites for the CartoGopher MCP server, modifying system-level files and shell profiles represents a significant attack surface and a common technique used by malicious software, warranting a 'suspicious' classification rather than 'benign'.