Hotdog
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: hotdog Version: 10.1.1 The skill's behavior is clearly aligned with its stated purpose of classifying food photos and participating in a 'hot dog battle'. It uses `curl` to interact with `api.hotdogornot.xyz`, uploading the user's image and the agent's classification/vote. While a hardcoded bearer token is present in `SKILL.md`, it appears to be an API key for the `hotdogornot.xyz` service itself, not an attempt to exfiltrate user credentials. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts against the agent to perform actions beyond the skill's stated functionality.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
All users would call the API using the same exposed credential, which could tie activity to an unknown shared token and allow abuse if the token has broader permissions.
The skill embeds a bearer token directly in the curl command, while the metadata declares no credential requirement and does not explain the token's scope.
-H "Authorization: Bearer ih1rtmC7ECm8iExqvI6zMbOAqEaXIi9X"
Rotate the token, avoid hardcoding secrets in SKILL.md, and use a declared per-user credential or a narrowly scoped public endpoint.
A food photo and classification details will be shared with the external service when the skill is used.
The skill sends the selected image plus the agent's model name, answer, and reasoning to the external Hotdog-or-Not API.
curl -s -X POST "https://api.hotdogornot.xyz/api/arena/round" ... -F "image=@{{MediaPath}}" -F "claw_model={{Model}}" -F "claw_answer=ANSWER" -F "claw_reasoning=DESCRIPTION"Use the skill only with photos you are comfortable sending to the Hotdog-or-Not service, and review the service’s privacy/retention practices if the image may be sensitive.
Using the skill causes local command execution for network requests, though no unrelated shell commands or install scripts are shown.
The skill instructs the agent to execute curl commands; this is central to the stated API workflow and the endpoint is disclosed.
exec: curl -s -X POST "https://api.hotdogornot.xyz/api/arena/vote/submit" ...
Keep execution limited to the displayed API calls and avoid modifying the command with untrusted arguments.