Back to skill
Skillv1.0.0
VirusTotal security
add-agent · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 4:40 AM
- Hash
- 79f26abdd940be69a5d7b96225afdb81e6a536dd18315b72a0d87e1a892be3e8
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: add-agent Version: 1.0.0 The skill is designed for administrative tasks, but it directly incorporates user-provided inputs (`AGENT_ID`, `AGENT_NAME`, `BOT_TOKEN`, `ALLOW_FROM`, `DESCRIPTION`) into shell commands and configuration files without explicit sanitization. This creates significant vulnerabilities, including potential shell injection (e.g., in `SKILL.md` step 4: `openclaw agents add ${AGENT_ID}`), JSON injection when updating `openclaw.json` (step 7), and prompt injection against the newly created agent by crafting `AGENT_NAME` or `DESCRIPTION` in its `SOUL.md`/`AGENTS.md` (step 6). While the skill's stated purpose is benign, these critical vulnerabilities could be exploited for unauthorized command execution or agent manipulation.
- External report
- View on VirusTotal