Freelance Pilot

• Analyzed: May 12, 2026, 4:01 AM
• Findings: 0
• Version: 1.0.0
• Hash: 4da5de677c3ee3bc416b5acbaac2d66f586fa03007ff78e3b76f65cbbb77a7aa
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: freelance-pilot Version: 1.0.0 The skill is classified as suspicious due to a critical shell injection vulnerability present in the `INTEGRATION.md` file. The instructions for the OpenClaw agent explicitly direct it to execute shell commands like `node freelance-pilot/index.js scan-job "[job text]"` and `node freelance-pilot/index.js calculate-bid [hours] [complexity]`. If the agent does not properly sanitize or escape the user-provided `[job text]`, `[hours]`, or `[complexity]` inputs before executing these commands, a malicious user could inject arbitrary shell commands, leading to remote code execution on the host system. While the `index.js` script itself appears benign, the integration instructions create a significant attack surface.