valuescan-skill-beta

• Analyzed: May 14, 2026, 7:56 AM
• Findings: 1
• Version: 1.0.7
• Hash: 52960e5e2d5b409758766191b7d0b5cfbe2b237d6786e8aa83e2cc7c3e0e0ee5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The ValueScan skill bundle is a legitimate cryptocurrency market analysis tool. The core logic in 'script/sdk/vs_api_sign.js' implements standard HMAC-SHA256 request signing using API credentials stored in a local configuration file (~/.openclaw/credentials/valuescan.json). The network communication is strictly limited to the official API domain (api-beta.valuescan.io), and the SKILL.md instructions provide clear, non-malicious guidance for the AI agent to map user queries to specific data endpoints. No evidence of data exfiltration, obfuscation, or unauthorized access was found.