Assistant Configurator

• Analyzed: Apr 1, 2026, 4:21 AM
• Findings: 1
• Version: 1.0.0
• Hash: e09bd225ca39b2222160838a8035577e44cbb25ff77a21c3f4091c18741a9e4a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides the AI agent with high-privilege administrative capabilities to read and modify the entire OpenClaw system configuration using the `gateway` tool (`config.get`, `config.patch`) as documented in `SKILL.md`. While these functions are consistent with the stated purpose of an 'assistant-configurator,' they grant the agent access to sensitive API keys, model settings, and service controls. The instructions demonstrate how to patch configurations and restart services, which poses a significant risk if the agent is manipulated via prompt injection. No clear evidence of intentional malice or data exfiltration was found, but the broad system access is inherently risky.