Auto news podcast

• Analyzed: May 10, 2026, 6:44 AM
• Findings: 1
• Version: 1.0.12
• Hash: 0d9eae2a44d459253eb125a33f37cda8e2bed118bcd5a0c716cb432673980287
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle possesses high-risk capabilities, specifically reading the global OpenClaw configuration file (~/.openclaw/openclaw.json) to retrieve sensitive API keys for various services (Tavily, Baidu, Unsplash, and LLM providers). The script `fetch_and_generate_v2.py` and the image search modules use these credentials to perform network requests and utilize `subprocess.run` to execute other local skills like `audio-cog` and `autoglm-generate-image`. While these behaviors are consistent with the stated goal of automated news generation, the access to system-wide secrets and the execution of sub-processes constitute a significant security risk, though no clear evidence of intentional malice or data exfiltration was identified.