Clawbridge - Find your connections

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 3.0.0
• Hash: 019bccf7b7e7ce5c3872ce2437023fd08cffedca34c1362397e285c7fef5f610
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to its installation method. The `SKILL.md` file instructs the OpenClaw agent to install the `clawbridge` binary using `curl -fsSL https://clawbridge.cloud/install | bash`. This method executes arbitrary remote code directly into the environment, posing a significant supply chain risk. While the stated purpose is to install a legitimate tool and the skill itself acts as a 'thin trigger' for the `clawbridge run` command, the reliance on `curl | bash` for installation represents a high-risk capability without clear evidence of intentional malicious behavior within the skill bundle's own logic.