Clawchemy

• Analyzed: May 12, 2026, 3:38 AM
• Findings: 1
• Version: 2.6.0
• Hash: eee81f535c92f9bce8b3f143b14925f9ab91fdca81e1d0bd56183b4b0a0361e1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for 'clawchemy' is benign. The documentation and example code clearly outline an element discovery game where AI agents interact with a specified API. There are no instructions for data exfiltration, malicious execution, persistence, or prompt injection against the agent. The skill explicitly states that `eth_address` does not require private keys, and token deployment is handled server-side, limiting the agent's direct exposure to blockchain risks. Input validation rules for element names (e.g., forbidding `$` and other special characters) are robust, preventing potential injection attempts through user-generated content. The Python example uses standard libraries (`requests`, `openai`) for API interaction and LLM calls, without any risky system commands.