Clawdwallet

• Analyzed: May 16, 2026, 3:20 AM
• Findings: 1
• Version: 0.1.0
• Hash: 14ebf730c83ffe7fe355602ac556da2bc30c81d990bf5556088e0b4ff06a290f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the agent to `git clone` and `npm install` an external GitHub repository (`https://github.com/NeOMakinG/clawdwallet.git`) in `SKILL.md`. This introduces a significant supply chain risk, as the agent is directed to download and execute arbitrary code from a third-party source. While the stated purpose is to control a Web3 wallet, which inherently involves high-risk capabilities like handling mnemonics and signing transactions, the reliance on external code without direct control over its content makes the skill suspicious due to the potential for compromise.