Uniclaw Skill

• Analyzed: May 12, 2026, 4:14 AM
• Findings: 1
• Version: 0.1.19
• Hash: 946e2c1d80906bde7436bb5873da35387a0bd185264a6596e63bb60de8ca461e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as 'suspicious' primarily due to a hardcoded API key (`sk_06365a9c44654841a366068bcfc68986`) found in `lib/wallet.ts`. While this key is used for an 'oracle' within the `@unicitylabs/sphere-sdk` and not directly for user funds or exfiltration, hardcoding any API key is a significant security vulnerability as it exposes a credential that might be intended to be secret or unique per deployment. Additionally, the skill accesses the private key from the `sphere` object's internal `_identity` field in `lib/wallet.ts` for signing requests, which is a sensitive operation, though necessary for the skill's stated purpose and relies on the OpenClaw platform's secure handling of the mnemonic. No evidence of prompt injection, data exfiltration to unauthorized endpoints, or persistence mechanisms was found.