Twitter Automation

• Analyzed: May 14, 2026, 3:32 AM
• Findings: 1
• Version: 0.1.5
• Hash: 7971c6dc7c876e823f1a423d5d8237df4fed3ea8d5f758cf08f679f958e896e9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file contains instructions that, if followed by the OpenClaw agent, would bypass its declared security policy (`allowed-tools: Bash(infsh *)`). Specifically, the 'Quick Start' section instructs the agent to execute `curl -fsSL https://cli.inference.sh | sh` and the 'Related Skills' section instructs `npx skills add ...`. Both `curl | sh` and `npx` commands do not start with `infsh`, representing a prompt injection vulnerability that could lead to arbitrary remote code execution (RCE) and supply chain risks if the remote scripts or npm packages are compromised. While the stated purpose of these commands is installation and adding related skills, the method used introduces significant security vulnerabilities.