Back to skill
Skillv1.0.3
VirusTotal security
NBA Tracker · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
ReviewApr 30, 2026, 6:41 AM
- Hash
- 1073499ff6cf44078b9ba29d4f9523402ed21fe6f265de5e38540ef9be066202
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: nba-tracker Version: 1.0.3 The skill bundle is classified as suspicious due to the inclusion of code in SKILL.md that uses subprocess.run to execute osascript for macOS Calendar integration. This implementation is vulnerable to AppleScript injection because it embeds unsanitized variables (such as player names and matchups) directly into a script string. While this functionality aligns with the stated purpose of adding games to a calendar, the use of shell-level execution for system automation is a high-risk capability that could be exploited if the agent processes malicious input.
- External report
- View on VirusTotal