Paprika

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 0.1.0
• Hash: 1c154015dbf85f61e2c326103cd6a691593f7f299b8ea347a4efe6dc5ba417c0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle defines a benign OpenClaw skill for interacting with Paprika Recipe Manager. The `SKILL.md` provides clear instructions for installation (`npm install -g paprika-recipe-cli`) and setup (setting `PAPRIKA_EMAIL` and `PAPRIKA_PASSWORD` environment variables), which are standard practices for CLI tools. All commands the agent is instructed to use are direct invocations of the `paprika` CLI tool, aligned with the stated purpose of accessing recipes, meal plans, and grocery lists. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation within the provided files. While `npm install` introduces a supply chain risk, the instruction itself is not malicious, and the agent's operational commands are limited to the `paprika` binary.