Token Scout

• Analyzed: May 11, 2026, 4:46 AM
• Findings: 0
• Version: 1.0.0
• Hash: 58e05a07d56927c571f4324582bfab460cca9743091d75145750f8d949686be7
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: token-scout Version: 1.0.0 The skill bundle is classified as suspicious due to multiple shell injection vulnerabilities present in all executable scripts (`find-accumulation.sh`, `small-cap-scanner.sh`, `token-lookup.sh`, `token-scanner.sh`). User-controlled inputs (e.g., `$CHAIN`, `$NETWORK`, `$TOKEN_ADDRESS`) are directly interpolated into `curl` command strings without proper sanitization or quoting, allowing for arbitrary command execution. For example, providing `base; cat /etc/passwd` as a chain name would execute `cat /etc/passwd`. Additionally, `token-lookup.sh` uses `sed` on user input, which could also be vulnerable to injection. While these are critical vulnerabilities, there is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts in `SKILL.md`.