Crabwalk

• Analyzed: May 12, 2026, 3:19 AM
• Findings: 1
• Version: 0.1.2
• Hash: edbb1e0a43f423250f69d0ed21888c2a4f7e7f8a168447708a12c47ccfcc9aaf
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to several high-risk capabilities, even though they are plausibly aligned with its stated purpose as a 'Real-time companion monitor'. Key indicators include the installation script in `skill.md` performing remote code execution by downloading and extracting binaries from GitHub releases (`https://github.com/luccast/crabwalk`), the use of `sudo` to install system packages (`qrencode`), and the documentation explicitly stating that the `crabwalk` tool will auto-detect and read the gateway token from `~/.openclaw/openclaw.json`. Additionally, the tool starts a network-facing server, exposing a service on the local network. While these actions are presented as necessary for the monitoring functionality, they collectively represent significant security risks without clear malicious intent being demonstrated.