中文技能发布工作流程

• Analyzed: May 8, 2026, 10:06 AM
• Findings: 1
• Version: 2.0.0
• Hash: 74cb809096b82a1d1edaad24c48b7ba77bf907b986b8e2d6a4f284750f299915
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a hardcoded ClawHub API token (clh_D_1J2_rsQs0XZbt_2Gf3LoRdyiUivZebillnWFdql1U) within a bash script template in SKILL.md (Section 5.1). While the workflow is designed for publishing skills to ClawHub, the inclusion of plaintext credentials and specific local file paths (e.g., /media/ezekiel/Merlin/...) indicates a significant security vulnerability and lack of sanitization. The instructions also require the agent to execute external Python scripts and CLI tools, which are necessary for the stated purpose but increase the attack surface.