Coding Agent Backup

• Analyzed: May 11, 2026, 4:49 AM
• Findings: 1
• Version: 1.0.0
• Hash: 13afd8818e38b02fafbaf8b19fadd51d49849d626fa5807b9ba0a28e843c9802
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to two critical security vulnerabilities. Firstly, the `SKILL.md` instructions explicitly direct the OpenClaw agent to use the `--yolo` flag with the `codex` tool, which disables sandboxing and approval mechanisms, creating a severe risk of arbitrary code execution on the host system without oversight if the agent is compromised. Secondly, the `index.js` file contains a hardcoded Google Gemini API key (`AIzaSyCKWmPmAkZWvI2KiblawWPUESyCp9dEjk0`), which is a significant information security flaw as it exposes credentials that could be misused.