Todolist Md Clawdbot Copy

• Analyzed: May 12, 2026, 4:03 AM
• Findings: 1
• Version: 1.0.0
• Hash: ecd15f33bd29b5722a6c94a6ae9877bbd6eb24902d2488d269419c629f348675
• Source: palm
• External report: View on VirusTotal

Findings (1)

OpenClaw Agent Skill The skill bundle is classified as suspicious due to the explicit use of `sudo -u ubuntu -H env ... gog ...` for external command execution in `scripts/todolist_drive_folder_agent.mjs` and `scripts/todolist_review_drive.py`. While this capability is presented as necessary for interacting with Google Drive via the `gog` CLI, it grants the AI agent the ability to execute arbitrary commands as the `ubuntu` user. This creates a significant Remote Code Execution (RCE) vulnerability, as a malicious prompt could potentially trick the agent into constructing and executing harmful commands, even if the arguments are passed as an array to `execFileSync`/`subprocess.check_output`. This high-risk capability, despite the benign stated purpose, elevates the classification to suspicious rather than benign.