Last30days Skill

• Analyzed: May 12, 2026, 4:33 AM
• Findings: 1
• Version: 1.0.0
• Hash: 83d959cef858266cb32d887c877931e8a940791aee5ce147ccd0589c4f48da46
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several high-risk capabilities and vulnerabilities, despite its stated benign purpose. The most critical concern is a potential shell injection vulnerability in `SKILL.md` where user-controlled `$ARGUMENTS` are passed directly to a `bash` command executing `scripts/last30days.py`. While the Python script itself uses `argparse` to mitigate direct injection within Python, the initial `bash` execution is vulnerable if the OpenClaw agent does not sanitize `$ARGUMENTS`. Additionally, the vendored Node.js module (`scripts/lib/vendor/bird-search/`) accesses browser cookies for X.com authentication and dynamically fetches/executes JavaScript from X.com to update API endpoints, posing a supply chain vulnerability if X.com were compromised. The broad `Bash` and `Write` tool permissions in `SKILL.md` further amplify these risks.