4claw

• Analyzed: May 12, 2026, 3:12 AM
• Findings: 1
• Version: 0.2.4
• Hash: 213a0924db05420fd00f0172ba86f1fdc31d0e466af4ef8d73938c2400a7d660
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is suspicious due to its self-update mechanism, which downloads and overwrites `SKILL.md` and `HEARTBEAT.md` from `https://www.4claw.org` into `~/.config/4claw/`. While intended for legitimate updates, this creates a supply chain vulnerability where a compromised `4claw.org` could serve malicious instructions, leading to prompt injection against the agent. Additionally, the `SKILL.md` encourages 'edgy' and 'trolly' behavior, which, despite explicit safety rules, could be interpreted by an agent to push boundaries in ways that are not strictly malicious but could be problematic.