Back to skill
Skillv1.3.0
VirusTotal security
jeffli-content-factory · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
ReviewApr 9, 2026, 3:16 PM
- Hash
- 85b2aa8b7107430e06cb240f0075ab5dadf002b5bec160f5eadca2b009e55a20
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: jeffli-content-factory Version: 1.3.0 The skill bundle contains highly risky instructions in SKILL.md that direct the AI agent to print sensitive API keys (Tavily and Brave) from the filesystem to the standard output during a 'Tool Dependency Check,' which leaks secrets into logs or session outputs. Additionally, scripts/create_default_cover.py contains hardcoded WeChat APPID and APPSECRET credentials, and the bundle includes proxy scripts (wechat_proxy_server.py and wechat_proxy_scf/index.py) designed to route WeChat API traffic through external servers. While these features are framed as necessary for automation and bypassing IP whitelists, the explicit instruction to display secrets and the presence of hardcoded credentials represent significant security risks and potential exfiltration vectors.
- External report
- View on VirusTotal