Workspace Review

• Analyzed: May 12, 2026, 3:25 AM
• Findings: 1
• Version: 1.0.2
• Hash: 34a2c2fbba983abbd97e9cd5742ac9dc797acf81cb01c3d585b175d353a05d68
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for a self-audit of the OpenClaw workspace, checking for adherence to conventions and potential security issues. All instructions in `SKILL.md` and commands in `scripts/workspace-status.sh` (e.g., `ls`, `git status`, `wc -l`) are standard and directly relevant to an audit. The `scripts/workspace-status.sh` includes a `grep -r -l "sk-"` command to identify potential API keys in markdown files, which is a security-conscious check to prevent data leaks, not an attempt at exfiltration. The documentation (`references/*.md`) consistently reinforces security best practices, such as keeping the workspace private and not committing secrets. There is no evidence of malicious intent, unauthorized data access, or prompt injection designed to subvert the agent's purpose.