WebClaw

• Analyzed: May 11, 2026, 4:40 AM
• Findings: 1
• Version: 2.1.3
• Hash: 8d3330697159d1bebf67c9e21e643a723ab22733781abdee455af97a613daae9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The webclaw skill bundle is a legitimate infrastructure component designed to provide a web-based UI for OpenClaw. It utilizes a standard web stack (FastAPI, Next.js, Nginx) and requires elevated privileges (sudo) to configure system services and SSL via Certbot, which is consistent with its stated purpose. The code follows security best practices, including regex-based domain validation in `scripts/db_query.py` to prevent injection, secure password hashing (PBKDF2), and parameterized database queries. While it fetches source code from a GitHub repository during installation, this is transparently documented and pinned to a specific release tag (v2.1.0).