builder-data

• Analyzed: May 14, 2026, 3:22 AM
• Findings: 1
• Version: 1.0.1
• Hash: 3c01c619c23ad0d38f7e1a8518d82ec3eb73bc8ed55d5bf44858080ce6e0ef58
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle 'talent-powers' is benign. It provides instructions and examples for querying professional data from Talent Protocol and enriching it with public GitHub data. The skill requires standard API keys (`TALENT_API_KEY`, optional `GITHUB_TOKEN` for rate limits) and interacts solely with `api.talentprotocol.com` and `api.github.com`. All instructions in `SKILL.md` and reference files are functional, guiding the agent on proper API usage and response handling, without any evidence of prompt injection to subvert the agent, exfiltrate sensitive data, or execute unauthorized commands. The use of `regexp` in `customQuery` for location filtering is a documented feature of the Talent Protocol API, not a malicious injection vector.