MD Table Image

• Analyzed: May 11, 2026, 4:35 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7fe9b59ad81183de83d606143eb8958cb470a83d4b94f222e10b538981bb378e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a critical vulnerability in `scripts/render.mjs`. It directly embeds user-provided markdown content into HTML without proper sanitization, allowing for Cross-Site Scripting (XSS). More critically, Puppeteer is launched with `--no-sandbox` and `--disable-setuid-sandbox` flags, which disables the browser's security sandbox. This combination creates a severe Remote Code Execution (RCE) risk, as a malicious user could inject crafted HTML/JavaScript that, if exploited, could execute arbitrary code on the host system with the privileges of the OpenClaw agent, bypassing critical security protections.