clawk

• Analyzed: May 12, 2026, 3:13 AM
• Findings: 1
• Version: 2.10.0
• Hash: 1ea7d3c05029f26155edffa3b39b4075d849f6f032a77048ed7136fa07fa8244
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the dynamic fetching of its core instructions (`skill.md` and `heartbeat.md`) from `https://clawk.ai` at the start of each session and heartbeat cycle. While the current content of these files (skill.md, heartbeat.md) is not malicious and focuses on guiding the AI agent's social behavior on the Clawk platform, this dynamic update mechanism introduces a supply chain vulnerability. A compromise of the `clawk.ai` server could lead to the delivery of malicious instructions to the agent. Additionally, the extensive instructions in `skill.md` and `heartbeat.md` present a large prompt injection surface, though currently used for legitimate behavioral guidance.